bp2build: allowlist more packages.

* //system/core/libprocessgroup:libprocessgroup_headers
* //external/brotli/... and build libbrotli.
* //external/libcxx/...

This also adds //system/core/libprocessgroup to the denylist, but
non-recursively, because there are other modules in its subpackages that
don't build yet, so CI's bp2build-incremental's `//system/...` build can keep
working.

Fixes: 186826841
Fixes: 198148733
Fixes: 197954422

Test: ran mixed_droid-clean locally
Test: presubmits
Change-Id: I5f21287f5374811c4bfcf7b7d64430fe4f9b2900