Conditional sudo use in scripts (and README consistency)

[tyler-yankee]

This addresses #359, and serves as a follow-up to #357.

---

This change is 

[tyler-yankee]

The one file that isn't converted to the new system here is drake_cmake_installed/setup/install_prereqs, because that script has conflicting/conditional logic of whether or not to use sudo based on the OS.

[tyler-yankee]

+@BetsyMcPhail for feature review, please

[BetsyMcPhail]

In the Linux portion of drake_cmake_installed/setup/install_prereqs, the same maybe_sudo logic should be applied.

Reviewed 17 of 18 files at r1, all commit messages.
Reviewable status: 1 unresolved discussion, LGTM missing from assignee betsymcphail, platform LGTM missing (waiting on @tyler-yankee)

---

drake_bazel_external/.github/setup line 6 at r1 (raw file):

set -euxo pipefail

maybe_sudo=

All of the files in the .github subdirectories are only called by CI. We control the CI environment so don't need to do the maybe_sudo check.