### What does this PR do?

Generalizes `bazel` CI configuration to make deeply nested `bazel[isk]` invocations in
`omnibus` scripts and `invoke` tasks automatically benefit from the CI configuration
(`--config=ci` as defined in `.bazelrc`).

### Motivation

**Problem with previous approach:**

GitLab cache configuration was cumbersome with deeply nested bazel invocations.
Each `variable`, `cache`, and their respective `paths` needed to be explicitly
propagated to every build job (and soon, test jobs). This created a maintenance
burden with multiple points of configuration scattered across the codebase.

**Solution:**

Centralize Bazel CI configuration in `.bazelrc` (single point of maintenance)
and propagate only two environment variables:
- `CI`: Triggers `--config=ci` in wrapper scripts
- `XDG_CACHE_HOME`: Root directory for both bazelisk and bazel caches

This allows all nested bazel invocations to automatically use:
- Remote cache configuration (from `.bazelrc`)
- (Semi-)persistent local caches
- Other CI-specific flags

### Changes

**1. Simplified wrapper scripts**

Both `tools/bazel` and `tools/bazel.bat` now:
- Require `XDG_CACHE_HOME` to be set in CI
- Validate that `XDG_CACHE_HOME` points to a directory
- Generate minimal `.user.bazelrc` with only `--config=ci`
- Use local `.cache` fallback when not in CI

**2. Standardized cache location via XDG_CACHE_HOME**

Per runner type:
- **Persistent Linux runners**: `/data/bzl` (on persistent volume)
- **Ephemeral Linux/macOS runners**: `$RUNNER_TEMP_PROJECT_DIR`
- **Windows runners**: `c:\bzl` (on persistent volume)

**3. Platform-specific implementation**

- **Linux/macOS**: Native XDG_CACHE_HOME support (Bazel 7.2.0+ / 8.4.0+)
- **Windows**: Emulated via `--output_user_root=$XDG_CACHE_HOME/bazel`

**4. Updated GitLab CI configuration**

- Introduced `.bazel:defs:posix`, `.bazel:defs:windows`, `.bazel:defs:posix-persistent`
- Removed GitLab cache configuration (replaced by persistent volumes)
- Pass `CI` and `XDG_CACHE_HOME` to all jobs, including Windows Docker containers

### Implementation Details

**Using $RUNNER_TEMP_PROJECT_DIR:**

GitLab Runner creates `$RUNNER_TEMP_PROJECT_DIR` alongside `$CI_PROJECT_DIR`
with the same lifecycle (created before job, cleaned after job). We generalized
its use based on positive experience from our earlier externalization of Bazel's
`--repo_contents_cache`, which required a directory outside the build tree to
avoid circular dependencies.

**Windows path handling:**

Windows wrapper converts backslashes to forward slashes for Bazel compatibility
(see github.com/bazelbuild/bazel/issues/3275).

**tools/bazel (POSIX):**
```bash
if [ -n "${CI:-}" ]; then
  # Validate XDG_CACHE_HOME is a directory
  # Generate user.bazelrc with --config=ci
fi
```

**tools/bazel.bat (Windows):**
```batch
if defined CI (
  # Validate XDG_CACHE_HOME is a directory
  # Set --output_user_root=%XDG_CACHE_HOME%/bazel
  # Generate user.bazelrc with --config=ci
)
```

### References

- XDG Base Directory Specification: https://specifications.freedesktop.org/basedir/latest/
- Bazel XDG support (Linux): bazelbuild/bazel#21817 (7.2.0)
- Bazel XDG support (macOS): bazelbuild/bazel#26773 (8.4.0)
- Bazel Windows backslash issue: bazelbuild/bazel#3275
- Windows XDG feature request: bazelbuild/bazel#27808