Make bazel build //external/... work by only allowing "approved" existing...

Make bazel build //external/... work by only allowing "approved" existing BUILD files in the Bazel workspace.

Test: bazel build //bionic/... //external/... //frameworks/... //system/...

Test: ./build/bazel/scripts/run_presubmits.sh

Change-Id: I91865ca87c6535053e7a14d2526ff3ce0991bfea