bazel: fetch pip wheels via the Bazel downloader

rules_python's whl_library shells out to a vendored pip to download wheels,
which fails frequently when PyPI's CDN (files.pythonhosted.org) returns 502s.

Between 2026-08-15 and 2026-08-18 this accounted for 90 of the 347 failed
jobs in the redpanda and vtools pipelines, 58 of them in whl_library.

Setting experimental_index_url switches whl_library to its rctx.download
branch and skips pip for wheel fetching: effective bazel will do the
download in the "bazel way": this means it gets cached through bazel-remote
via the asset cache feature (which we recently turned on).

--require-hashes goes away: it was effectively unused as rules_python strips it,
and it can break for "source dist" libraries, which we don't currently
materialize in the build but which exist in our build. The hashes are
already checked in the lockfile.

Fixes CORE-17093