bazel_4: init at 4.0.0

Bazel 4 is going to be a long term support release.

Latest version in NixPkgs so far was 3.3.1
There's a need for more recent version
NixOS#97497

All versions from 3.5.0 to 3.7.1 had some reproducibility issues
as noted in issue above, but there also seems to be
a working PR for 3.7.1 now at
NixOS#105439

Notable changes from bazel_3 setup:
- put python to default bash path

  For autodetecting python toolchain
  with strict action_env on and without this change
  bazel would fail to autodetect host python.

  There are some repos that define hermetic python
  toolchains, but they aren't easy to use yet. Also
  telling python paths to bazel isn't a 1-liner it
  seems:
  - action_env=PATH would affect cache
  - declaring toolchain via BUILD&WORKSPACE files
    is not per-user but more like per-repo and
    affects cache too

  Using python from nixpkgs shouldn't be too bad
  in the lack of simpler hermetic python toolchain
  options

- bazel_4.updater is bazel on `bazel query` to support
  new constructs in WORKSPACE (load of vars, transitive
  load etc). This is more robust but requires bazel
  to run the updater, using bazel_3 for now. This is
  only needed to bump package version, doesn't introduce
  bazel_4 build dependency on bazel_3

https://blog.bazel.build/2020/11/10/bazel-4.0-announce.html
https://blog.bazel.build/2020/11/10/long-term-support-release.html
bazelbuild/bazel#12455
https://github.com/bazelbuild/bazel/releases/tag/4.0.0
https://blog.bazel.build/2021/01/19/bazel-4-0.html