Subrule implicit dependencies are checked against the using rule's .bzl

Description of the bug:

Rules and aspects perform visibility checks for their default label inputs relative to their declaration site (as opposed to where they are used). This helps to keep implementation details from leaking.

However this does not currently apply to subrules, which have their default label inputs checked relative to the consuming rule/aspect.

Which category does this issue belong to?

Rules API

What's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

https://github.com/Silic0nS0ldier/bazel-subrule-visibility-repro

Which operating system are you running Bazel on?

Linux

What is the output of bazel info release?

release 9.2.0

If bazel info release returns development version or (@non-git), tell us how you built Bazel.

No response

What's the output of git remote get-url origin; git rev-parse HEAD ?

NA, private repo.

If this is a regression, please try to identify the Bazel commit where the bug was introduced with bazelisk --bisect.

No response

Have you found anything relevant by searching the web?

Called out by #21572 which was closed due to misattribution at the time.

Any other information, logs, or outputs that you want to share?

Error example;

~/work/canva-2 ❯ bazel cquery //web/src/pages/editor:page
...
INFO: Invocation ID: b4c6f31c-5d9a-489c-aa04-88f19a080199
ERROR: /home/coder/work/canva-2/web/src/pages/editor/BUILD.bazel:268:12: in _webpack_page_outputs rule //web/src/pages/editor:page: Visibility error:
target '//tools/build/zipcreate:zipcreate' is not visible from
target '//web/tools/bazel/webpack:webpack_bin.bzl'
Recommendation: modify the visibility declaration if you think the dependency is legitimate. For more info see https://bazel.build/concepts/visibility
ERROR: /home/coder/work/canva-2/web/src/pages/editor/BUILD.bazel:268:12: Analysis of target '//web/src/pages/editor:page' (config: a11112e) failed
ERROR: Analysis of target '//web/src/pages/editor:page' failed; build aborted
INFO: Elapsed time: 12.360s
INFO: 0 processes.
ERROR: Build did NOT complete successfully

The actual declaration site of the //tools/build/zipcreate:zipcreate dependency is within the same package (//tools/build/zipcreate:defs.bzl).