bazel/ci: unify developer-local and CI build generation.

[htuch]

This patch dedupes the distinct approaches that existed previously, where we assembled hand curated
BUILD files for external dependencies to be used in developer-local builds and used prebuilt
artifacts compiled under the external dependency's native build system for CI.

In the new approach, the CI flow continues to prebuild artifacts with the build recipes and
recursive make in ci/build_container/{Makefile,build_recipes}, ahead of time and prior to any
invocation of Bazel.

Developer-local builds will not prebuild, but instead invoke the same build recipes and recursive
make under a Bazel genrule. The trick here is that we can no longer use globs to refer to the build
artifacts in BUILD rules, since Bazel doesn't know about the outputs of the genrule ahead of time,
so we need to use a generated BUILD, produced by the bazel/gen_prebuilt.sh script, which does an
offline build first, analyzes the outputs and then produces a BUILD file stating what the genrule
outputs. This is only done once by a developer making an external dependency change, prior to
checking in the change.

There's a change to how external dependencies are specified as a result. Instead of adding new
external dependencies to ci/build_container/BUILD, they are added to the definitions at the start
of bazel/gen_prebuilt.py. The developer who is adding the external dependency then runs:

ENVOY_SRC_DIR=$PWD ./bazel/gen_prebuilt.sh

and checks in the resulting generated bazel/prebuilt.bzl file.

Existing users of the CI flow (Lyft) will need to make a slight tweak to how the prebuilt artifacts
are generated - the thirdparty/ and thirdparty_build/ directories will need to be generated with
the BUILD_DISTINCT=1 Makefile setting in #714.

A significant improvement that is also provided by this patch is the automatic workspace population
via prebuilt.bzl. See the changes to WORKSPACE and ci/WORKSPACE. Projects that consume Envoy, e.g.
to link in additional filters, no longer need to track Envoy's dependencies and maintain their own
bind rules, this is now automagic.

[htuch]

@mattklein123 for review and Lyft integration discussion. @lizan for Bazel review. @dnoe and @rlazarus for dog fooding with the new dependencies they plan on adding to gflags and backwards/elfutils.

[mattklein123]

@htuch does this need to be split somehow so it can pass CI? The bazel build is failing.

[htuch]

Yes, let me split out the base image part, sorry.

[lizan]

we had similar hack in istio before, if you only intended use protobuf.bzl from this protobuf repo, use new_git_repository with build_file_content = "", it will disable the BUILD file in protobuf root, so the anything else (cc_library, etc) won't be loaded.

[htuch]

Good point, wil fix.

[htuch]

There may be a cleaner way to do this actually, that doesn't involve offine .bzl generation, by defining a repository_rule and doing this entirely in Skylark. I'll see if it's easy to do, because if it is then this review can be dropped and we can get the same outcome with fewer moving parts.