Partially back out change to PYTHON_FOR_BUILD_ONLY.

This broke packages that needed a target Python at build-time.
Instead, change it from defined/undefined to yes/no/tool.  Most cases
of defined used `yes' anyway; fix the few stragglers do that instead.
New case `tool' is for TOOL_DEPENDS rather than buildlink3.
Fix cross-build of gnupg with CC_FOR_BUILD=NATIVE_CC.
Fix cross-build of libksba with CC_FOR_BUILD=NATIVE_CC.