After picking up #12337, I can't get our visibility overrides going.

For context, we don't have Envoy as a git submodule and instead it we fetch it via bazel as a tarball using http_archive.

Doing something like:

ADDITIONAL_VISIBILITY = [
  '@foo//pinterest:__subpackages__'
]

in our extensions_build_config.bzl fails with:

ERROR: /private/var/tmp/_bazel_rgs/6fea2029bf5452e6659bcb3f721f95cc/external/envoy/BUILD:18:14: invalid package name '@foo//pinterest:__subpackages__': must start with '//'

cc: @lizan @alyssawilk