The existing from-source setup scripts are deprecated and will be
removed after 2025-07-01:
- setup/ubuntu/install_prereqs.sh
- setup/ubuntu/source_distribution/install_prereqs_user_environment.sh

Instead, users and developers should run setup/install_prereqs (not as
root).

Bug fixes:
- Promote ca-certificates to binary prerequisites. It's required when
  PackageMap downloads https archives (e.g., package://drake_models).

Usability changes:
- Users never run any of our commands under sudo; we'll request sudo if
  and only if we actually need superuser access.
- Fine-tuned log output, with option for --verbose (e.g., in CI).
- Skip unnecessary steps; incremental runs are typically sub-second.

Maintainability changes:
- One single-file program to maintain, instead of an assortment of bash
  scripts and source and exec each other in weird ways.
- Always use files, not heredocs. (The pkg-config etc in a heredoc were
  documented as unwanted when using Drake's Debian packages, but that
  was wrong; we always want those deps even in Debian packages.) All of
  the new entries in our txt files are ported over from heredocs, as is
  the bazelisk metadata.
- Flavors are now a linear stack, not pick-and-choose hodgepodge. This
  substantially reduces our testing / verification burden. Filenames of
  txt files now exactly match the flavor names.
- Smoother control flow which should pave the way to supporting more
  kinds of platforms beyond Ubuntu. Adding more and better kinds of
  error handling or reporting will be easier now (vs bash).

Website changes:
- Major updates to from_source that explain how to install from CMake.
- Rework the Bazel introductory text to be focused on developers only.