Content-defined chunking added to Bazel

This is something I'm very interested in implementing for Docker builds. I've tested out CDC for the final image outputs, it results in smaller outputs but requires tuning between saved space versus request count when pulling. For build cache it might be even more advantageous.

Doesn't this mean that malicious inputs can deliberately cause super tiny or super huge chunks?