Add retry and resilience flags to curl across CI scripts (#2789)

### Summary of Changes

macOS runner jobs (and other high-concurrency jobs) were hitting `curl:
(56) Recv failure: Connection reset by peer` when downloading
`bazelci.py` and other CI scripts from `raw.githubusercontent.com`
during presubmit bursts (see e.g.
https://buildkite.com/bazel/google-bazel-presubmit/builds/107235#019ffa4b-8415-4f2b-82ee-44ea81ad81c4).

This adds `-fsSL --retry 5 --retry-delay 2 --retry-max-time 60
--retry-connrefused --connect-timeout 10` via a shared `CURL_FLAGS`
constant and `curl_download_command()` helper in `bazelci.py` across all
CI download sites.

These flags are supported across all CI runner platforms (including
older platforms like Rocky Linux 8 and Ubuntu 20.04).