[wip] fix various bazel incompatibilities

[cryslith]

Changes to bazel to fix various incompatibilities from upgrading to version 0.28

Some API changes happened. handled by patching zip_file

• incompatible_depset_union: Disallow union operator on depsets bazelbuild/bazel#5817, Master is broken due to depset changes #403
• incompatible_disable_deprecated_attr_params: Cleanup skylark 'attr' API bazelbuild/bazel#5818
• incompatible_new_actions_api: Remove the old (deprecated) actions API bazelbuild/bazel#5825

bugfix in bazel exposes a minor error in one of our BUILD files, fixed

• incompatible_disallow_native_in_build_file: Forbid native module in BUILD files bazelbuild/bazel#7513

rules_go no longer declares some modules we were using, so we import those ourselves

• https://github.com/bazelbuild/rules_go/blob/0.19.0/go/workspace.rst#proto-dependencies

However, the big problem is changes around python 2/3 version:

• incompatible_use_python_toolchains: The Python runtime is obtained from a toolchain rather than a flag bazelbuild/bazel#7899
• incompatible_py3_is_default: Bazel configures targets for Python 3 by default bazelbuild/bazel#7359

problem with pkg_deb, can be partially solved by migrating to rules_pkg 0.2.0's pkg_deb (see bazelbuild/bazel#8489):

• pkg_deb flag decoding breaks for python3. bazelbuild/rules_pkg#35

however, there's a python3 bug in containerregistry (which seems kinda poorly maintained) which isn't yet fixed. (and doesn't have any sign of being fixed soon)

• Doens't work with Bazel 0.25.0 because it uses Python 3 by default google/containerregistry#153

And the new fix for rules_pkg fails to be python2 compatible:

• make_deb.py errors on python 2 bazelbuild/rules_pkg#61

So I downgraded rules_pkg back to 0.1.0 and forced python 2 for now. (Which is also what rules_k8s did, see bazelbuild/rules_k8s#305)

However, we hit another containerregistry bug which I don't understand. Didn't check if it occurs with previous version of bazel yet.

$ bazel build @containerregistry//:pusher.par --host_force_python=PY2 --sandbox_debug --verbose_failures         
INFO: Analyzed target @containerregistry//:pusher.par (30 packages loaded, 486 targets configured).
INFO: Found 1 target...
ERROR: [...]/external/containerregistry/BUILD.bazel:67:1: Building par file @containerregistry//:pusher.par failed (Exit 1) process-wrapper failed: error executing command 
  (cd [...]/sandbox/processwrapper-sandbox/12104/execroot/__main__ && \
  exec env - \
    PATH=/usr/local/bin:/usr/bin:/bin \
    TMPDIR=/tmp \
  [...]/_embedded_binaries/process-wrapper '--timeout=0' '--kill_delay=15' bazel-out/host/bin/external/subpar/compiler/compiler.par --manifest_file bazel-out/k8-fastbuild/bin/external/containerregistry/pusher.par_SOURCES --outputpar bazel-out/k8-fastbuild/bin/external/containerregistry/pusher.par --stub_file bazel-out/k8-fastbuild/bin/external/containerregistry/pusher --zip_safe True external/containerregistry/tools/fast_pusher_.py)
src/main/tools/process-wrapper-legacy.cc:58: "execvp(bazel-out/host/bin/external/subpar/compiler/compiler.par, ...)": No such file or directory
Target @containerregistry//:pusher.par failed to build
INFO: Elapsed time: 0.417s, Critical Path: 0.08s
INFO: 2 processes: 2 processwrapper-sandbox.
FAILED: Build did NOT complete successfully

There's probably other python 2/3 bugs that I didn't hit because I couldn't get past the containerregistry one.

---

Checklist:

• I have split up this change into one or more appropriately-delineated commits.
• The first line of each commit is of the form "[component]: do something"
• I have written a complete, multi-line commit message for each commit.
• I have formatted any Go code that I have changed with gofmt.
• I have signed each commit with my GPG key.
• My changes have passed CI.
• I have built my changes locally, and tested that the changes work as expected.
• I have deployed a cluster incorporating my changes, and checked that it deploys successfully.
• I have assigned this issue to an appropriate reviewer. (Choose @celskeggs if you are not otherwise certain.)
• I consider my PR complete and ready to be merged without my further input, assuming that it passes CI and code review.

[cryslith]

It's not quite clear to me how we end up depending on containerregistry, btw.

[cryslith]

@celskeggs Is there any change in here you didn't pull into #407?

[celskeggs]

Yes, there are some changes in here that I didn't pull into #407:

• --incompatible_use_python_toolchains=false
• the # rules_go comment (by accident)
• the rules_pkg changes
• the hash-compute.py changes
• the version.bzl change
  Those weren't needed to be compatible with 0.26.1.

[celskeggs]

This has substantially been subsumed into #478, so I'm closing it.