Canary new Bazel versions and experimental flags in CI

To avoid surprises like the Bazel 0.25 release (which required an immediate fix and bump in https://github.com/envoyproxy/envoy/pull/6773), one approach is to add Envoy to Bazel CI in https://github.com/envoyproxy/envoy/issues/2461.

Another approach is to flip flags governing breaking behavior ahead of Bazel releases. See:

• https://docs.bazel.build/versions/master/backward-compatibility.html for the Bazel flag policy
• https://github.com/philwo/bazelisk for a tool that can run specific Bazel versions

I think that if we sort https://github.com/envoyproxy/envoy/issues/2461 then we are most of the way there, but filing this in case anyone is interested in pursuing this path in the meanwhile or in parallel.