Handle all `-isystem` variant flags in cargo build script path rewriting (#3996)

## Summary

Handle all `-isystem` variant flags in cargo build script path
rewriting.

## Problem

When Bazel passes CC toolchain flags to cargo build scripts, paths
following `-isystem` are prefixed with `${pwd}` so they resolve
correctly inside the sandbox. However, several other Clang flags that
take system include paths were not handled:

- `-stdlib++-isystem` — C++ standard library headers
- `-isystem-after` — appended to SYSTEM include search path
- `-cxx-isystem` — C++ SYSTEM include search path

See the [Clang command line
reference](https://clang.llvm.org/docs/ClangCommandLineReference.html)
for the full set.

This caused cargo build scripts to fail when the CC toolchain used any
of these flags, because paths weren't rewritten for the sandbox.

## Fix

Add `-stdlib++-isystem`, `-isystem-after`, and `-cxx-isystem` to the
flag list in `_pwd_flags_isystem`.

---

> **Note:** This PR was largely AI-generated using Claude Code, with
human review and guidance throughout.

Co-authored-by: Tamas Vajk <tamas.vajk@databricks.com>