Figure out a good strategy for managing python version/s

### description

some parts of tooling/ci require python3.8 and more generally recent python 3.x versions have syntax incompatibility

for those reasons the envoy-build-image sets python3.8 as the default interpreter

some OS dont have support for this out of the box so we could do with a good strategy for handling this

a couple of ideas in this respect are:

- use a `python_runtime` bazel rule to pull in the required py version
- explicitly set python3.8 in the shebang lines so devs can keep lower versions without having to update-alternatives or similar
- use a venv runtime (i think this is the least prefered option for various reasons)