Mark war-provided libraries as neverlink inside the Gerrit tree

When Gitiles is built as a Gerrit plugin from source, the plugin jar was
packaging the full transitive closure of libraries that Gerrit already
ships in gerrit.war (Guava, Gson, Soy, ICU4J, JGit, commons-lang3/io,
text/reload4j/flogger, ASM, html-types, ...). That inflated gitiles.jar
to ~34 MB of classes that are already on the plugin's runtime classpath
via gerrit.war -- pure duplication.

Introduce lib/provided.bzl with a provided_java_library() wrapper: a
single java_library whose neverlink attribute is a select() on the
existing @com_googlesource_gerrit_bazlets//flags:in_gerrit_tree flag.

Gerrit sets that flag in its .bazelrc; standalone Gitiles never does, so
it defaults to false.

* Standalone (flag false): the libraries are linked exactly as before
  and bundled into gitiles.war -- no behavioral change, zero regression
  risk.
* In the Gerrit tree (flag true): they become neverlink, so their
  classes are dropped from the plugin's runtime closure and are not
  re-packaged into gitiles.jar. Gerrit already provides them.

Only libraries that gerrit.war actually ships are converted (lib/BUILD,
lib/soy, lib/flogger). Gitiles-only libraries (the commonmark family,
java-prettify and autolink) stay linked in both configurations.

Alternative considered: exclude the same closure with deploy_env from
within the Gerrit plugin's BUILD (the pattern used by other plugins). We
defer that here because in_gerrit_tree is more principled -- Gitiles
itself declares "these are provided when I'm built inside Gerrit," so
the knowledge lives with the dependency declarations instead of being
duplicated as an exclusion list in Gerrit's plugin wiring. deploy_env
remains a viable follow-up if we later prefer to keep this decision
entirely on the Gerrit side.

Change-Id: I4f12d3a4be71a89df8830ecc872877f869997a8c