bazel: add another config_setting incompatible flag

.bazelrc

@@ -31,8 +31,9 @@ build --action_env=PATH --host_action_env=PATH
 build --enable_platform_specific_config
 build --test_summary=terse
 
-# TODO(keith): Remove once this is the default
+# TODO(keith): Remove once these 2 are the default
 build --incompatible_config_setting_private_default_visibility
+build --incompatible_enforce_config_setting_visibility
 
 # Allow tags to influence execution requirements
 common --experimental_allow_tags_propagation

bazel/repositories.bzl

@@ -221,7 +221,12 @@ def envoy_dependencies(skip_targets = []):
     external_http_archive("bazel_toolchains")
     external_http_archive("bazel_compdb")
     external_http_archive("envoy_build_tools")
-    external_http_archive("rules_pkg")
+
+    # TODO(keith): Remove patch when we update rules_pkg
+    external_http_archive(
+        "rules_pkg",
+        patches = ["@envoy//bazel:rules_pkg.patch"],
+    )
     external_http_archive("com_github_aignas_rules_shellcheck")
     external_http_archive("aspect_bazel_lib")
     _com_github_fdio_vpp_vcl()

bazel/rules_pkg.patch

@@ -0,0 +1,12 @@
+--- pkg/private/BUILD
++++ pkg/private/BUILD
+@@ -55,6 +55,9 @@ exports_files(
+ config_setting(
+     name = "private_stamp_detect",
+     values = {"stamp": "1"},
++    # When --incompatible_config_setting_private_default_visibility is set, this fails unless this is public.
++    # TODO: refactor to clear up confusion that this is a "private" target with public access.
++    visibility = ["//visibility:public"],
+ )
+
+ py_library(