Fail if non-allowlisted host system tool is used.

This CL improves the clarity of the non-hermetic nature of using
HostSystemTools, and make the build fail if a caller tries to use a host
system tool that isn't allowlisted in config.go.

The only caller seems to be for xcrun, which is a special case that is
pretty hard to remove.

Test: TH presubmit
Change-Id: Icd3e7330406a08c00ac9682e37e2d42669f2e6b7