Migrate to bazel modules

Since Gerrit 3.13, Project.NameKey is an interface. A jar built from
the current master targets the 3.3 API and fails every non-admin
project creation with:

  IncompatibleClassChangeError: Found interface
  com.google.gerrit.entities.Project$NameKey, but class was expected
  at ProjectCreationValidator.validateProject(ProjectCreationValidator.java:238)

The sources need no change: built in-tree against Gerrit master, all
21 tests pass. Only the standalone build is broken, as it still relies
on WORKSPACE and bazlets pinned to 3.3.

Migrate it to Bazel modules, following rename-project's migration, and
target the 3.14.4 API with the current bazlets.

- .bazelversion is 8.6.0, not 9.x: with Bazel 9.1, bazlets' transitive
  aspect_bazel_lib@2.11.0 fails to load (rule() got unexpected keyword
  argument 'incompatible_use_toolchain_transition').
- .bazelrc calls python3, since python is missing on current
  distributions.

Known gap: standalone `bazel test //...` fails with
NoClassDefFoundError: org/bouncycastle/openpgp/PGPException, as the
standalone test classpath lacks BouncyCastle. It fails the same way
against the 3.13.5 API, so this is a bazlets issue, not a plugin one.
In-tree tests are unaffected.

Change-Id: If052078bd78b08d545189e02c68a96333be7b6d5