Always repin when building servlet-4 branch

Currently, the servlet-4 build can fail if jgit brings in different
versions of dependencies than the ones expected. From a build
perspective, this shouldn't result in a failure as there is nothing
wrong in the servlet-4 branch, but rather Gerrit will need to repin the
dependencies.

The problem is a direct consequence of a missing functionality [1] in
bzlmod, when using rules_jvm_external with module dependency layering:
there is currently no mechanism for the root module to globally enforce
its declared dependency versions across the full resolved Maven graph
contributed by child modules.

In order to avoid build failures when JGit brings in new or updated
deps, always repin; this way, the build will successfully pass. If the
Gerrit builds, then stops working. We'll need to update Gerrit itself.

[1] https://github.com/bazel-contrib/rules_jvm_external/issues/1549

Bug: Issue 527954021
Change-Id: I74ce6c8b2d5ab27d7e06ed8b3edd4b46047e3b3e
diff --git a/vars/gerritJGitServlet4Pipeline.groovy b/vars/gerritJGitServlet4Pipeline.groovy
index f5e69e0..9a4b2b3 100644
--- a/vars/gerritJGitServlet4Pipeline.groovy
+++ b/vars/gerritJGitServlet4Pipeline.groovy
@@ -87,6 +87,7 @@
             dir('gerrit') {
               sh """
                 . set-java.sh 21
+                REPIN=1 bazelisk run @external_deps//:pin
                 bazelisk build release
               """
             }