Get matplotlib working with upstream Python

This patch adds support for using matplotlib plus its Gtk backend with
`--config=k8_upstream_python`. Unfortunately, the Tk backend doesn't
work because of how Python is packaged. See the following issue for
more information:
https://github.com/matplotlib/matplotlib/issues/23074

Separately, we need to patch pygobject and matplotlib for various
hermeticity reasons. To accomplish this, I've added patching support
for wheels downloaded via rules_python. I should have set it up to use
annotations (the same mechanism we use for injecting deps), but it was
a little cumbersome. Annotations are not set up for using in arguments
to repository rules. I instead opted for a separate JSON file. You can
find it at `tools/python/patches.json`.

You can try the two new example programs:

    $ bazel run --config=k8_upstream_python //build_tests:matplotlib_example
    $ bazel run --config=k8_upstream_python //build_tests:pygobject_example

Signed-off-by: Philipp Schrader <philipp.schrader@gmail.com>
Change-Id: I3c4e8648a8012aa23dedd53610e82d590d1c409d
diff --git a/third_party/python/pygobject/init.patch b/third_party/python/pygobject/init.patch
new file mode 100644
index 0000000..9604628
--- /dev/null
+++ b/third_party/python/pygobject/init.patch
@@ -0,0 +1,60 @@
+commit fe03a5f1aa619f4c1208ca1dce7d98db513dbec8
+Author: Philipp Schrader <philipp.schrader@gmail.com>
+Date:   Thu Oct 27 20:28:03 2022 -0700
+
+    Make pygobject hermetic
+
+diff --git a/site-packages/gi/__init__.py b/site-packages/gi/__init__.py
+index 3454790..a6f3246 100644
+--- a/site-packages/gi/__init__.py
++++ b/site-packages/gi/__init__.py
+@@ -27,6 +27,49 @@ import os
+ import importlib
+ import types
+ 
++from bazel_tools.tools.python.runfiles import runfiles
++
++def _hermeticity_fixup():
++    _runfiles = runfiles.Create()
++    runfiles_dir = _runfiles.EnvVars()["RUNFILES_DIR"]
++    if not runfiles_dir:
++        raise FileNotFoundError("Failed runfiles lookup.")
++
++    gtk_runtime_dir = os.path.join(runfiles_dir, "gtk_runtime")
++
++    ld_library_path = os.getenv("LD_LIBRARY_PATH") or ""
++    if ld_library_path:
++        ld_library_path = ":" + ld_library_path
++
++    os.environ["LD_LIBRARY_PATH"] = ":".join([
++        gtk_runtime_dir + "/lib/x86_64-linux-gnu",
++        gtk_runtime_dir + "/usr/lib/x86_64-linux-gnu",
++    ]) + ld_library_path
++
++    os.environ["GI_GIR_PATH"] = os.path.join(gtk_runtime_dir, "usr", "share", "gir-1.0")
++    os.environ["GI_TYPELIB_PATH"] = os.path.join(gtk_runtime_dir, "usr", "lib",
++                                                 "x86_64-linux-gnu",
++                                                 "girepository-1.0")
++
++    os.environ["GIO_EXTRA_MODULES"] = os.path.join(gtk_runtime_dir, "usr", "lib", "x86_64-linux-gnu", "gio", "modules")
++
++    # Tell fontconfig where to find the sandboxed font files.
++    os.environ["FONTCONFIG_PATH"] = os.path.join(gtk_runtime_dir, "etc/fonts/")
++    os.environ["FONTCONFIG_FILE"] = os.path.join(gtk_runtime_dir, "etc/fonts/fonts.conf")
++    # The sysroot here needs to be "/". If it were _base, then the font caches
++    # would contain _base-relative paths in them. Unfortunately pango interprets
++    # those as absolute paths and ends up failing to find all fonts.
++    os.environ["FONTCONFIG_SYSROOT"] = "/"
++    os.environ["GDK_PIXBUF_MODULEDIR"] = os.path.join(gtk_runtime_dir, "usr", "lib",
++                                                      "x86_64-linux-gnu", "gdk-pixbuf-2.0",
++                                                      "2.10.0", "loaders")
++    os.environ["GDK_PIXBUF_MODULE_FILE"] = os.path.join(os.environ["GDK_PIXBUF_MODULEDIR"], "loaders.cache")
++    os.system(os.path.join(gtk_runtime_dir, "usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/gdk-pixbuf-query-loaders") + " --update-cache")
++
++
++_hermeticity_fixup()
++
++
+ _static_binding_error = ('When using gi.repository you must not import static '
+                          'modules like "gobject". Please change all occurrences '
+                          'of "import gobject" to "from gi.repository import GObject". '