Enforce that BAZEL_USE_HOST_SYSROOT can only be True or False

[krinkinmu]

Commit Message:

When I tried to backport #43681 and #43731 to 1.37 release branch Copilot pointed out that I didn't validate the value of BAZEL_USE_HOST_SYSROOT and just included it as-is into the generated Starlak script.

It does not seem to be a particularly critical issue, but it's also easy to fix, so let's just fix it.

Additionnally, while backporting I discovered that ./ci/do_ci.sh deps fails currently with the following error:

Observed dataplane core deps {'rules_python', 'fips_go_linux_amd64', 'fips_go_linux_arm64', 'fips_cmake_linux_x86_64', 'com_github_nghttp2_nghttp2', 'zlib', 'com_github_nlohmann_json', 'googleurl', 'boringssl', 'com_googlesource_code_re2', 'envoy_repo', 'com_google_protobuf_protoc_osx_x86_64', 'com_github_axboe_liburing', 'com_github_libevent_libevent', 'com_google_protobuf_protoc_linux_ppcle_64', 'dev_cel', 'com_google_protobuf_protoc_win64', 'rules_foreign_cc', 'com_github_fmtlib_fmt', 'io_bazel_rules_go', 'com_github_jbeder_yaml_cpp', 'com_github_cncf_xds', 'com_google_protobuf_protoc_osx_aarch_64', 'prometheus_metrics_model', 'envoy_toolshed', 'aws_lc', 'com_google_googleapis', 'fips_cmake_linux_aarch64', 'rules_cc', 'com_github_zlib_ng_zlib_ng', 'fips_ninja', 'com_github_cyan4973_xxhash', 'com_google_absl', 'com_github_google_perfetto', 'com_github_grpc_grpc', 'com_google_protobuf_protoc_linux_aarch_64', 'com_google_protobuf', 'com_google_protobuf_protoc_linux_x86_64', 'com_google_protoconverter', 'com_github_gabime_spdlog', 'com_envoyproxy_protoc_gen_validate', 'com_github_openhistogram_libcircllhist', 'rules_license', 'com_github_google_quiche'} is not covered by "use_category" implied core deps {'com_github_openzipkin_zipkinapi', 'gperftools', 'rules_python', 'fips_go_linux_amd64', 'fips_go_linux_arm64', 'fips_cmake_linux_x86_64', 'com_github_nghttp2_nghttp2', 'zlib', 'com_github_nlohmann_json', 'googleurl', 'boringssl', 'com_googlesource_code_re2', 'com_github_cares_cares', 'com_google_protobuf_protoc_osx_x86_64', 'com_github_axboe_liburing', 'com_github_libevent_libevent', 'com_google_protobuf_protoc_linux_ppcle_64', 'rules_foreign_cc', 'com_google_protobuf_protoc_win64', 'dev_cel', 'com_github_fmtlib_fmt', 'com_github_jbeder_yaml_cpp', 'io_bazel_rules_go', 'com_google_protobuf_protoc_osx_aarch_64', 'prometheus_metrics_model', 'com_github_cncf_xds', 'rules_proto', 'envoy_toolshed', 'aws_lc', 'com_google_googleapis', 'fips_cmake_linux_aarch64', 'rules_cc', 'toolchains_llvm', 'rules_rust', 'com_github_zlib_ng_zlib_ng', 'com_github_google_tcmalloc', 'com_github_cyan4973_xxhash', 'com_google_absl', 'fips_ninja', 'com_github_google_perfetto', 'com_github_grpc_grpc', 'opentelemetry_proto', 'com_google_protobuf_protoc_linux_aarch_64', 'bazel_skylib', 'com_google_protobuf', 'rules_buf', 'com_google_protobuf_protoc_linux_x86_64', 'com_google_protoconverter', 'com_github_gabime_spdlog', 'com_envoyproxy_protoc_gen_validate', 'com_github_openhistogram_libcircllhist', 'rules_license', 'com_github_google_quiche'}: {'envoy_repo'} are missing

The failure is due to the fact that envoy_repo repository rule is listed when we query dependencies in Bazel, but because it's not actually an external repository we don't list it in bazel/deps.yaml. So the checker complains that we have an unexpected dependency.

This PR adds envoy_repo to the list of ignored dependencies because it falls under the category of "internal repository structure", so it should be ok to exclude.

Additional Description: n/a
Risk Level: low
Testing: build locally with local sysroot in FIPS mode and without FIPS.
Docs Changes: n/a
Release Notes: n/a
Platform Specific Features: n/a

[phlax]

lgtm, thanks @krinkinmu