Enable github caching of Bazel's repository cache.

This should substantially reduce network flakes, since most builds will no longer need to download external dependencies.  Because these caches actually get pretty expensive (~300 MB just from 1 openjdk dependency), we've taken some precautions:

1) The caches only get updated on push events (i.e. post-submit jobs)
2) Only a single job will push a new cache for any os/branch/commit combination.  This will be whichever job finishes its bazel run first, and *also* has updates for the cache.  Over time, the cache should expand to the full set of transitive dependencies as the quicker jobs stop pushing updates.
3) A clear_caches workflow has been introduced to reset the caches in case they grow too large.  This will run monthly for now, but can also be run manually.

PiperOrigin-RevId: 508133044