bazel-at-head-plus-downstream needs to be split and/or individual projects need to be able to add flags

[thomasvl]

Spawned from https://github.com/bazelbuild/rules_apple/issues/468.

rules_apple already has https://github.com/bazelbuild/rules_apple/blob/master/.bazelci/presubmit.yml#L17-L33, and that lets us add flags need to manually stay green on last green while addressing issue. But to stay green on bazel-at-head-plus-downstream, we have to add temp flags to our whole config, that means we loose the ability to ensure we don't break against the current releases because we're adding flags that really should be specific to prereleases.

I'm not sure how common this in, the python ones triggering this are especially bad because behaviors have been changed, but they don't yet work for all use cases, so there really isn't a clear path for how we'll end up having to change things, so the flag is the best choice what details are still being sorted out.

[philwo]

@fweikert Can you have a look? You’re the expert on this stuff :)

[thomasvl]

Also, if the flag needed is too new, then the project can't globally add it because the older blazes won't know about it which likely means bazel would error for the unknown flag.