Enforce that BAZEL_USE_HOST_SYSROOT can only be True or False (#43800)

Commit Message:

When I tried to backport #43681 and #43731 to 1.37 release branch
Copilot pointed out that I didn't validate the value of
BAZEL_USE_HOST_SYSROOT and just included it as-is into the generated
Starlak script.

It does not seem to be a particularly critical issue, but it's also easy
to fix, so let's just fix it.

Additionnally, while backporting I discovered that `./ci/do_ci.sh deps`
fails currently with the following error:

```
Observed dataplane core deps {'rules_python', 'fips_go_linux_amd64', 'fips_go_linux_arm64', 'fips_cmake_linux_x86_64', 'com_github_nghttp2_nghttp2', 'zlib', 'com_github_nlohmann_json', 'googleurl', 'boringssl', 'com_googlesource_code_re2', 'envoy_repo', 'com_google_protobuf_protoc_osx_x86_64', 'com_github_axboe_liburing', 'com_github_libevent_libevent', 'com_google_protobuf_protoc_linux_ppcle_64', 'dev_cel', 'com_google_protobuf_protoc_win64', 'rules_foreign_cc', 'com_github_fmtlib_fmt', 'io_bazel_rules_go', 'com_github_jbeder_yaml_cpp', 'com_github_cncf_xds', 'com_google_protobuf_protoc_osx_aarch_64', 'prometheus_metrics_model', 'envoy_toolshed', 'aws_lc', 'com_google_googleapis', 'fips_cmake_linux_aarch64', 'rules_cc', 'com_github_zlib_ng_zlib_ng', 'fips_ninja', 'com_github_cyan4973_xxhash', 'com_google_absl', 'com_github_google_perfetto', 'com_github_grpc_grpc', 'com_google_protobuf_protoc_linux_aarch_64', 'com_google_protobuf', 'com_google_protobuf_protoc_linux_x86_64', 'com_google_protoconverter', 'com_github_gabime_spdlog', 'com_envoyproxy_protoc_gen_validate', 'com_github_openhistogram_libcircllhist', 'rules_license', 'com_github_google_quiche'} is not covered by "use_category" implied core deps {'com_github_openzipkin_zipkinapi', 'gperftools', 'rules_python', 'fips_go_linux_amd64', 'fips_go_linux_arm64', 'fips_cmake_linux_x86_64', 'com_github_nghttp2_nghttp2', 'zlib', 'com_github_nlohmann_json', 'googleurl', 'boringssl', 'com_googlesource_code_re2', 'com_github_cares_cares', 'com_google_protobuf_protoc_osx_x86_64', 'com_github_axboe_liburing', 'com_github_libevent_libevent', 'com_google_protobuf_protoc_linux_ppcle_64', 'rules_foreign_cc', 'com_google_protobuf_protoc_win64', 'dev_cel', 'com_github_fmtlib_fmt', 'com_github_jbeder_yaml_cpp', 'io_bazel_rules_go', 'com_google_protobuf_protoc_osx_aarch_64', 'prometheus_metrics_model', 'com_github_cncf_xds', 'rules_proto', 'envoy_toolshed', 'aws_lc', 'com_google_googleapis', 'fips_cmake_linux_aarch64', 'rules_cc', 'toolchains_llvm', 'rules_rust', 'com_github_zlib_ng_zlib_ng', 'com_github_google_tcmalloc', 'com_github_cyan4973_xxhash', 'com_google_absl', 'fips_ninja', 'com_github_google_perfetto', 'com_github_grpc_grpc', 'opentelemetry_proto', 'com_google_protobuf_protoc_linux_aarch_64', 'bazel_skylib', 'com_google_protobuf', 'rules_buf', 'com_google_protobuf_protoc_linux_x86_64', 'com_google_protoconverter', 'com_github_gabime_spdlog', 'com_envoyproxy_protoc_gen_validate', 'com_github_openhistogram_libcircllhist', 'rules_license', 'com_github_google_quiche'}: {'envoy_repo'} are missing
```

The failure is due to the fact that `envoy_repo` repository rule is
listed when we query dependencies in Bazel, but because it's not
actually an external repository we don't list it in `bazel/deps.yaml`.
So the checker complains that we have an unexpected dependency.

This PR adds `envoy_repo` to the list of ignored dependencies because it
falls under the category of "internal repository structure", so it
should be ok to exclude.


Additional Description: n/a
Risk Level: low
Testing: build locally with local sysroot in FIPS mode and without FIPS.
Docs Changes: n/a
Release Notes: n/a
Platform Specific Features: n/a

---------

Signed-off-by: Mikhail Krinkin <mkrinkin@microsoft.com>

Author: krinkinmu

bazel/repo.bzl

@@ -102,6 +102,10 @@ def _envoy_repo_impl(repository_ctx):
     # RBE), as host environment variables are not directly passed to remote workers.
     local_sysroot = repository_ctx.os.environ.get("BAZEL_USE_HOST_SYSROOT", "False")
 
+    # Make sure to not pass the content of environment variable directly to the Bazel
+    # Starlark file - we should only accept a proper boolean value and nothing else.
+    local_sysroot = {"True": True, "False": False}.get(local_sysroot, False)
+
     repository_ctx.file("compiler.bzl", """
 LLVM_PATH = '%s'
 USE_LOCAL_SYSROOT = %s

tools/dependency/validate.py

@@ -23,7 +23,7 @@
 IGNORE_DEPS = set([
     'envoy',
     'envoy_api',
-    'envoy_api',
+    'envoy_repo',
     'platforms',
     'bazel_tools',
     'local_config_cc',