fix: build_data_writer.ps1 encoding and ACLs (#3604)

Windows Powershell APIs have several quirks that can make a file
problematic if
typical Linux semantics are assumed

* BOM header bytes can be written, which break regular UTF8 parsing
* The file can be left open, which prevents later deletion of it
* The files can be written with limited permissions, leading to
permission errors later.

To fix, use alternative Powershell APIs for writing the text file. Also
explicitly set
permissions on the output.

I came across this when Windows starting running the build data tests in
non-zip mode,
where the original file permissions are kept.

Author: rickeylev

CHANGELOG.md

@@ -92,6 +92,7 @@ END_UNRELEASED_TEMPLATE
   fixing missing transitive dependencies when extras contain hyphens
   (e.g., `sqlalchemy[postgresql-psycopg2binary]`).
   ([#3587](https://github.com/bazel-contrib/rules_python/issues/3587))
+* (binaries/tests) Stamped build data generated by Windows actions is readable
 
 {#v0-0-0-added}
 ### Added

python/private/build_data_writer.ps1

@@ -1,17 +1,29 @@
 $OutputPath = $env:OUTPUT
-
-Add-Content -Path $OutputPath -Value "TARGET $env:TARGET"
-Add-Content -Path $OutputPath -Value "CONFIG_MODE $env:CONFIG_MODE"
-Add-Content -Path $OutputPath -Value "STAMPED $env:STAMPED"
+$Lines = @(
+    "TARGET $env:TARGET",
+    "CONFIG_MODE $env:CONFIG_MODE",
+    "STAMPED $env:STAMPED"
+)
 
 $VersionFilePath = $env:VERSION_FILE
-if (-not [string]::IsNullOrEmpty($VersionFilePath)) {
-    Get-Content -Path $VersionFilePath | Add-Content -Path $OutputPath
+if (-not [string]::IsNullOrEmpty($VersionFilePath) -and (Test-Path $VersionFilePath)) {
+    $Lines += Get-Content -Path $VersionFilePath
 }
 
 $InfoFilePath = $env:INFO_FILE
-if (-not [string]::IsNullOrEmpty($InfoFilePath)) {
-    Get-Content -Path $InfoFilePath | Add-Content -Path $OutputPath
+if (-not [string]::IsNullOrEmpty($InfoFilePath) -and (Test-Path $InfoFilePath)) {
+    $Lines += Get-Content -Path $InfoFilePath
 }
 
+# Use .NET to write file to avoid PowerShell encoding/locking quirks
+# We use UTF8 without BOM for compatibility with how the bash script writes (and
+# what consumers expect).
+$Utf8NoBom = New-Object System.Text.UTF8Encoding $False
+[System.IO.File]::WriteAllLines($OutputPath, $Lines, $Utf8NoBom)
+
+$Acl = Get-Acl $OutputPath
+$AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("Everyone", "Read", "Allow")
+$Acl.SetAccessRule($AccessRule)
+Set-Acl $OutputPath $Acl
+
 exit 0