Get matplotlib working with upstream Python

This patch adds support for using matplotlib plus its Gtk backend with
`--config=k8_upstream_python`. Unfortunately, the Tk backend doesn't
work because of how Python is packaged. See the following issue for
more information:
https://github.com/matplotlib/matplotlib/issues/23074

Separately, we need to patch pygobject and matplotlib for various
hermeticity reasons. To accomplish this, I've added patching support
for wheels downloaded via rules_python. I should have set it up to use
annotations (the same mechanism we use for injecting deps), but it was
a little cumbersome. Annotations are not set up for using in arguments
to repository rules. I instead opted for a separate JSON file. You can
find it at `tools/python/patches.json`.

You can try the two new example programs:

    $ bazel run --config=k8_upstream_python //build_tests:matplotlib_example
    $ bazel run --config=k8_upstream_python //build_tests:pygobject_example

Signed-off-by: Philipp Schrader <philipp.schrader@gmail.com>
Change-Id: I3c4e8648a8012aa23dedd53610e82d590d1c409d
diff --git a/WORKSPACE b/WORKSPACE
index 1f3a7ae..eaa227f 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -414,6 +414,7 @@
     patch_args = ["-p1"],
     patches = [
         "//third_party:rules_python/0001-Support-overriding-individual-packages.patch",
+        "//third_party:rules_python/0002-Allow-user-to-patch-wheels.patch",
     ],
     sha256 = "497ca47374f48c8b067d786b512ac10a276211810f4a580178ee9b9ad139323a",
     strip_prefix = "rules_python-0.16.1",
@@ -430,10 +431,14 @@
 
 load("@python3_9//:defs.bzl", python_interpreter = "interpreter")
 load("@rules_python//python:pip.bzl", "pip_parse")
+load("//tools/python:package_annotations.bzl", PYTHON_ANNOTATIONS = "ANNOTATIONS")
 
 pip_parse(
     name = "pip_deps",
+    annotations = PYTHON_ANNOTATIONS,
+    enable_implicit_namespace_pkgs = True,
     overrides = "//tools/python:whl_overrides.json",
+    patch_spec = "//tools/python:patches.json",
     python_interpreter_target = python_interpreter,
     require_overrides = RUNNING_IN_CI,
     requirements_lock = "//tools/python:requirements.lock.txt",
@@ -692,8 +697,8 @@
 http_archive(
     name = "gtk_runtime",
     build_file = "@//debian:gtk_runtime.BUILD",
-    sha256 = "934693e64bfe63f0c55cdf432fe183eb077d6875d4d6a3dce4e47dbe7e20f5a9",
-    url = "https://www.frc971.org/Build-Dependencies/gtk_runtime-3.tar.gz",
+    sha256 = "5a6014d1783363be6bc95843d03bbb6513e650eaea60be2b1a4c65bf21981f9b",
+    url = "https://www.frc971.org/Build-Dependencies/gtk_runtime-4.tar.gz",
 )
 
 # Downloaded from