make sure that individual bazel tests on CI are not re-fetching the remote resources

[RussTedrake]

Right now, bazel tests that require AddRemote (e.g. via the remotes.py) are being given the tag requires-network. But i just saw at least one error on docker CI where the intended prefetching was not actually stopping the spot notebook from re-downloading the assets during the test.

• CI should fail if the individual test is trying to access the network. i could accomplish this by removing the requires-network tags. (they would still need the no-sandbox tag)
• local users should be able to run bazel test //... and be successful without having to manually call the prefetch.
  • Maybe it's ok as a stop-gap to have a clear error message that reminds them to call prefetch_remotes if needed.
  • maybe I could make a requires-network-only-local tag, that gets turned into requires-network (in python/defs.bzl::_common_attrs()) when running locally, but gets removed when running on CI, e.g. via another --define. that's likely best.