libdeps tool has the ability to selective mark certain libraries as being whole archive links or not, and then make sure the libraries are on the link line in the correct order, while also correctly enabling the group flags around the specific libraries. for example, notice the --whole-archive and --no-whole-archive flag groups switching on and off around the appropriate libraries:

/opt/mongodbtoolchain/v4/bin/g++ -o build/cached/third_party/wiredtiger/wt -Wl,--fatal-warnings -B/opt/mongodbtoolchain/v4/bin -gdwarf-5 -pthread -Wl,-z,now -fuse-ld=lld -fstack-protector-strong -gdwarf64 -Wl,--build-id -Wl,--hash-style=gnu -Wl,-z,noexecstack -Wl,--warn-execstack -Wl,-z,relro -Wl,--compress-debug-sections=none -Wl,-z,origin -Wl,--enable-new-dtags -pie -rdynamic build/cached/third_party/wiredtiger/src/utilities/util_alter.o build/cached/third_party/wiredtiger/src/utilities/util_backup.o build/cached/third_party/wiredtiger/src/utilities/util_compact.o build/cached/third_party/wiredtiger/src/utilities/util_cpyright.o build/cached/third_party/wiredtiger/src/utilities/util_create.o build/cached/third_party/wiredtiger/src/utilities/util_downgrade.o build/cached/third_party/wiredtiger/src/utilities/util_drop.o build/cached/third_party/wiredtiger/src/utilities/util_dump.o build/cached/third_party/wiredtiger/src/utilities/util_list.o build/cached/third_party/wiredtiger/src/utilities/util_load.o build/cached/third_party/wiredtiger/src/utilities/util_load_json.o build/cached/third_party/wiredtiger/src/utilities/util_loadtext.o build/cached/third_party/wiredtiger/src/utilities/util_main.o build/cached/third_party/wiredtiger/src/utilities/util_misc.o build/cached/third_party/wiredtiger/src/utilities/util_printlog.o build/cached/third_party/wiredtiger/src/utilities/util_read.o build/cached/third_party/wiredtiger/src/utilities/util_rename.o build/cached/third_party/wiredtiger/src/utilities/util_salvage.o build/cached/third_party/wiredtiger/src/utilities/util_stat.o build/cached/third_party/wiredtiger/src/utilities/util_truncate.o build/cached/third_party/wiredtiger/src/utilities/util_upgrade.o build/cached/third_party/wiredtiger/src/utilities/util_verbose.o build/cached/third_party/wiredtiger/src/utilities/util_verify.o build/cached/third_party/wiredtiger/src/utilities/util_write.o build/cached/third_party/wiredtiger/libwiredtiger.a -Wl,--whole-archive build/cached/third_party/wiredtiger/libwiredtiger_checksum.a -Wl,--no-whole-archive build/cached/third_party/zstandard/libzstd.a build/cached/third_party/zlib/libzlib.a -Wl,--whole-archive build/cached/third_party/snappy-1.1.7/libsnappy.a build/cached/third_party/gperftools/libtcmalloc_minimal.a build/cached/third_party/unwind/libunwind.a -Wl,--no-whole-archive -llzma -llzma -lm -lresolv -lcrypto -lssl -lcrypto -ldl -lrt -ldl

This might require a custom rule, I am not sure you can sprinkle flags in like this very easily with the cc_ native rules.