bazel: Make use of new incremental pip installer

[phlax]

Signed-off-by: Ryan Northey ryan@synca.io

Commit Message: bazel: Make use of new incremental pip installer
Additional Description:

this rationalizes the pip dependencies down to ~1 requirements file (there are a few others left for non bazel requirements atm)

also removes dep comments, as previously requested by @moderation

Risk Level:
Testing:
Docs Changes:
Release Notes:
Platform Specific Features:
[Optional Runtime guard:]
[Optional Fixes #Issue]
[Optional Deprecated:]
[Optional API Considerations:]

[repokitteh-read-only]

CC @envoyproxy/dependency-shepherds: Your approval is needed for changes made to (bazel/.*repos.*\.bzl)|(bazel/dependency_imports\.bzl)|(api/bazel/.*\.bzl)|(.*/requirements\.txt)|(.*\.patch).

🐱

Caused by: #18026 was opened by phlax.

see: more, trace.

[phlax]

8( this seems to be blocked by bazel-contrib/rules_python#527

[zuercher]

/wait

[phlax]

unblocked by using upstream main/HEAD

[zuercher]

/assign-from @envoyproxy/dependency-shepherds

[repokitteh-read-only]

@envoyproxy/dependency-shepherds assignee is @mattklein123

🐱

Caused by: a #18026 (comment) was created by @zuercher.

see: more, trace.

[phlax]

following up offline conversation with @htuch - this currently removes the requirements.txt from the kafka extension

we may, for purposes of code ownership, want to keep some requirements.txt files separate - like, eg, the kafka one

mho is that we (want to) maintain the deps across the repo, and that doesnt tend to be so related to codeownership, more dependency shepherding, so for the sake of making the latter easier, the less dependabotted files the better

[moderation]

/lgtm deps

[htuch]

LGTM, but I do remain a little uneasy at the lack of versioning in requirements.in. I'm going to go with what you said in your other review and accept that we probably don't care most of the time and when we do, we have the option to pin.

[phlax]

@mattklein123 i had to readd the requirements file for code_format

[phlax]

I'm going to go with what you said in your other review and accept that we probably don't care most of the time and when we do, we have the option to pin.

yep, we can

not sure if you saw my other comment about cross-platform compilation of the lock file

atm pip-compile doesnt do the right thing on this, so if you want eg a package only on windows, you need to add it without any predicates, and then add in bazel so its only loaded in win