Figure out a good strategy for managing python version/s

description

some parts of tooling/ci require python3.8 and more generally recent python 3.x versions have syntax incompatibility

for those reasons the envoy-build-image sets python3.8 as the default interpreter

some OS dont have support for this out of the box so we could do with a good strategy for handling this

a couple of ideas in this respect are:

• use a python_runtime bazel rule to pull in the required py version
• explicitly set python3.8 in the shebang lines so devs can keep lower versions without having to update-alternatives or similar
• use a venv runtime (i think this is the least prefered option for various reasons)