Skip cloning the repo in the first step of Google Bazel Presubmit (#2930)

By default, all "command" steps in a Buildkite job will clone the git
repo associated with the Buildkite pipeline. We can skip this checkout
by setting `checkout: skip: true` in the step config.

We do this for the first step of Google Bazel Presubmit, which doesn't
actually need more than the presubmit.yml file (except for checking if
modified files include sensitive yaml files -- which we now disable with
an environment variable). To get the presubmit.yml, we directly fetch it
from googlesource, though it's base64-encoded -- so we decode it.