ci: cache Bazel builds

[mattnworb]

Summary

• cache Bazelisk and downloaded Bazel versions
• cache external repositories to reduce repeated dependency downloads
• cache Bazel build outputs separately for each tested Bazel version
• make pull-request runs restore-only so trusted main builds populate caches
• run push presubmits only on main, avoiding duplicate branch-push and pull-request matrices