runnable_binary: avoid using > on the output file

In bazel-contrib#1267 there was an issue where, somehow, the wrapper script ended up as
a zero-length file but the action succeeded (resulting in storing a
zero-length file instead of the script in the caches). genrules are
documented as running inside `-ueo pipefail` so it seems like
this should be impossible...

In any case, this avoids using >$@ because the > runs before the command
itself does, creating a zero-length file before populating it, and is
the only way I could think of that this ends up as an empty file.
Hopefully, if the problem repeats, genrule will notice that the file
didn't get created and fail.

foreign_cc/utils.bzl

@@ -44,7 +44,8 @@ def runnable_binary(name, binary, foreign_cc_target, match_binary_name = False,
 
     wrapper_cmd = """
     sed s@EXECUTABLE@$(rlocationpath {name})@g $(location @rules_foreign_cc//foreign_cc/private:runnable_binary_wrapper.sh) > tmp
-    sed s@SH_BINARY_FILENAME@{sh_binary_filename}@g tmp > $@
+    sed s@SH_BINARY_FILENAME@{sh_binary_filename}@g tmp > tmp2
+    mv tmp2 $@
     """
 
     if hasattr(native, "package_relative_label"):