FetchContent: Reject CMAKE_TOOLCHAIN_FILE env var in sub-build

The sub-build should never try to use a toolchain file. The toolchain file may itself be getting downloaded by FetchContent. If the CMAKE_TOOLCHAIN_FILE environment variable is set, CMake uses it to initialize the CMake variable of the same name. We need to explicitly clear them before the first project call of the sub-build.

While we're at it, there was a mix of ${} and @-@ substitutions in the CMakeLists.txt.in file. It is sometimes useful to temporarily put ${} evaluations there while working on issues (like this one), but they get replaced. Using @ONLY leaves them untouched and uses a consistent substitution method for the whole file. This MR adds a preceding commit to address this.

Fixes: #24535 (closed)