Reorganize and cull cc_library_static denylist.

Take two: this time, put libasync_safe on the mixed build denylist
because it seems to break things.

Test: Presubmits + testing the offending action using a Ninja
invocation. "m droid dist" also running.

Change-Id: I7912b6670980776d981d874dab157b0268693ab2