[CI] Fix root user and Windows PyGithub import errors

[andrew-anyscale]

Two CI failures from running under Bazel 7:

• WORKSPACE: add ignore_root_user_error = True to python_register_toolchains.
  rules_python refuses to run as root (privileged containers in CI), which
  blocks Bazel analysis of any py_binary target that depends on py_deps_py310.

• ci/ray_ci/tester_container.py: make CITestStateMachine import lazy.
  The top-level import github (PyGithub) pulls in PyJWT -> cryptography,
  whose Rust extension DLL fails to load on Windows. The state machine is
  only ever called on master branch postmerge pipelines, so it is safe to
  defer the import to move_test_state(). This is also a step toward removing
  the PyGithub dependency entirely.

Topic: libup-build-config
Relative: libup-deps
Signed-off-by: andrew andrew@anyscale.com

[andrew-anyscale]

Reviews in this chain:
└#61668 [Build] Add java_binary all_tests_bin as deploy-jar source for Java tests
　└#61669 [Build] Replace rules_boost lzma patches with a custom org_lzma_lzma build file
　　└#61694 [Build] Patch protobuf for Bazel 7 exec_tools removal
　　　└#61695 [Build] Upgrade rules_apple/apple_support and set macOS toolchain flags for Bazel 7
　　　　└#61601 [Build] Upgrade Bazel from 6.5.0 to 7.5.0
　　　　　└#61725 [Build] Upgrade protobuf 28.2, absl 20240722.0, grpc 1.68.2, boringssl
　　　　　　└#61726 [CI] Fix root user and Windows PyGithub import errors

[andrew-anyscale]

#	head	base	diff	date	summary
0	6da2a310	bce7cf5b	diff	Mar 13 12:10 PM	2 files changed, 3 insertions(+), 1 deletion(-)

[gemini-code-assist]

Code Review

This pull request introduces two fixes for CI failures. The first change allows Python toolchains in Bazel to run as root, which is necessary for privileged CI containers. The second change defers an import in a Python script to work around a dependency issue on Windows. My review focuses on improving the maintainability of these changes by suggesting the addition of comments to explain the rationale behind these non-obvious fixes. This will help future developers understand the context and prevent potential regressions.

[gemini-code-assist]

To improve clarity for future maintainers, it would be helpful to add a comment explaining why ignore_root_user_error is necessary. This will provide context about the CI environment and prevent accidental removal.

    # Required for running in privileged CI containers that run as root.
    ignore_root_user_error = True,

[gemini-code-assist]

For maintainability, please add a comment explaining why this import is deferred. This will prevent future developers from moving it to the top of the file and re-introducing the bug on Windows.

# Defer import to avoid cryptography dependency failing on Windows.
# This function is only called in postmerge pipelines, where this is safe.
from ray_release.test_automation.ci_state_machine import CITestStateMachine