Wheel builder option for SNOPT_PATH

[jwnimmer-tri]

Is your feature request related to a problem? Please describe.

When building wheels using GitHub actions, I need to support a different way of accessing the secret snopt code. As of today, the builder assumes that git credentials are available directly. This ends up being a struggle to provide as part of GitHub actions.

Describe the solution you'd like

When running bazel run //tools/wheel:builder, there should be an option to configure SNOPT_PATH to point to a file. This is the current work-around I'm using:

From a076627438435c08c202a7d0c7a1e4ba1a5d1a50 Mon Sep 17 00:00:00 2001
From: Jeremy Nimmer <jeremy.nimmer@tri.global>
Date: Sun, 21 Apr 2024 15:22:42 -0700
Subject: [PATCH] SNOPT_PATH

---
 tools/wheel/image/build-drake.sh | 2 +-
 tools/wheel/macos/build-wheel.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/wheel/image/build-drake.sh b/tools/wheel/image/build-drake.sh
index 30c947d2bd84..72175d93e345 100755
--- a/tools/wheel/image/build-drake.sh
+++ b/tools/wheel/image/build-drake.sh
@@ -16,7 +16,7 @@ cat > /opt/drake-wheel-build/drake-build/drake.bazelrc << EOF
 build --disk_cache=/var/cache/bazel/disk_cache
 build --repository_cache=/var/cache/bazel/repository_cache
 build --repo_env=DRAKE_OS=manylinux
-build --repo_env=SNOPT_PATH=git
+build --repo_env=SNOPT_PATH=/tmp/snopt.tar.gz
 build --config=packaging
 build --define=LCM_INSTALL_JAVA=OFF
 EOF
diff --git a/tools/wheel/macos/build-wheel.sh b/tools/wheel/macos/build-wheel.sh
index f43a97b6861a..4788e91bd2cb 100755
--- a/tools/wheel/macos/build-wheel.sh
+++ b/tools/wheel/macos/build-wheel.sh
@@ -79,7 +79,7 @@ cat > "$build_root/drake.bazelrc" << EOF
 build --disk_cache=$HOME/.cache/drake-wheel-build/bazel/disk_cache
 build --repository_cache=$HOME/.cache/drake-wheel-build/bazel/repository_cache
 build --repo_env=DRAKE_OS=macos_wheel
-build --repo_env=SNOPT_PATH=git
+build --repo_env=SNOPT_PATH=/tmp/snopt.tar.gz
 build --config=packaging
 build --define=LCM_INSTALL_JAVA=OFF
 # See tools/wheel/wheel_builder/macos.py for more on this env variable.

Instead of hard-coding that with a patch file, I'd like to pass a flag on the command line.

Note that this flag only needs to work when --no-provision is in effect. There is no need to add logic to copy the SNOPT_PATH file from outside to inside of Docker. (However, if it makes it easier to test locally by support the docker-aware file copying as part of this work, that's fine too.)