.bazelrc: Update 'strict_action_env' flag

'--experimental_strict_action_env' was a Bazel 0.20.0 option which got
renamed to '--incompatible_strict_action_env' and was planned to be the
default as of 0.21.0 [1]. However, this planned flip still hasn't
happened for at least the baseline of 1.0.0 (as of rc3), so we can't
remove it as of now [2].

In general, we should try to avoid having --incompatible_* or
--experimental_* flags in the bazelrc, as per explanation in Issue 11122
[3] as well as on the 'Backward Compatibility' page of Bazel [4]:

> Users should never run their production builds with --experimental_*
> or --incompatible_* flags.

However, for this case we have a compelling reason to have
'--incompatible_strict_action_env'.

[1]: bazelbuild/bazel#6648
[2]: bazelbuild/bazel#7026
[3]: https://bugs.chromium.org/p/gerrit/issues/detail?id=11122
[4]: https://docs.bazel.build/versions/0.29.1/backward-compatibility.html

Change-Id: Ie78708ffaeb1bfe9ebceb924939833f7c30eaeaf

.bazelrc

@@ -1,10 +1,16 @@
 build --workspace_status_command=./tools/workspace-status.sh --strategy=Closure=worker
 build --repository_cache=~/.gerritcodereview/bazel-cache/repository
-build --experimental_strict_action_env
 build --action_env=PATH
 build --disk_cache=~/.gerritcodereview/bazel-cache/cas
 build --java_toolchain //tools:error_prone_warnings_toolchain
 
+# Enable strict_action_env flag to. For more information on this feature see
+# https://groups.google.com/forum/#!topic/bazel-discuss/_VmRfMyyHBk.
+# This will be the new default behavior at some point (and the flag was flipped
+# shortly in 0.21.0 - https://github.com/bazelbuild/bazel/issues/7026). Remove
+# this flag here once flipped in Bazel again.
+build --incompatible_strict_action_env
+
 test --build_tests_only
 test --test_output=errors