Adapt to Gerrit's use of bazel modules

Turn off strict_visibility in the rules_jvm_external maven_install used
for @external_plugin_deps.

With strict_visibility enabled, transitively resolved Maven artifacts
are generated with //visibility:private and cannot be referenced
directly from plugin BUILD targets. This conflicts with Bazel strict-
deps, which requires direct dependencies to be listed when their types
are used at compile time.

For example, scribejava-apis depends transitively on scribejava-core,
but plugin sources extending DefaultApi20 must add
@external_plugin_deps//:com_github_scribejava_scribejava_core as a
direct dependency to satisfy strict-deps. With strict_visibility enabled
this fails due to visibility restrictions.

Disabling strict_visibility allows depending on such transitively
resolved artifacts directly, while still keeping strict-deps enabled to
enforce explicit compile-time dependencies.

To support both standalone and in-tree build modes, split the Maven
repositories into:

  * a shared "external_plugin_deps" repository that contains only
    Gerrit-provided APIs (gerrit-plugin-api and acceptance framework)
    and does not define a lock file

  * a plugin-specific repository ("oauth_plugin_deps") that contains
    the plugin's bundled runtime dependencies and owns its lock file

This allows:

  - bazlets to continue referencing @external_plugin_deps for
    Gerrit API dependencies in standalone mode without bundling
    them into the plugin

  - plugin runtime dependencies to remain reproducible via
    lock files

  - multiple plugins to coexist in an in-tree build without
    contributing conflicting lock files for the same repository

Provide a MODULE.bazel fragment that can be linked into Gerrit's
`plugins/external_plugin_deps.MODULE.bazel` when the plugin is built
inside the Gerrit source tree.

This allows the plugin to be built in-tree without modifying Gerrit's
main module configuration beyond including this fragment.

Update the build documentation to describe how to link the fragment
and run plugin tests in this configuration.

Change-Id: Ib3e8ee4012c8180131b26622dfacc29e31834646