Add external repos required by tests and a "fetch all" filegroup.

This is used to prefetch all external repositories required by our integration tests. A follow-up CL will then instruct the "inner Bazel" running inside the tests to use the repositories from the "outer Bazel"'s "external" folder, instead of downloading / extracting them itself. This results in a massive reduction of I/O and network traffic when running integration tests and will also allow us to disable network access in the sandbox by default for our tests, resulting in better hermeticity and reduces the risk of accidental additions of remote dependencies.

The cost is that we have to take a bit more care when maintaining our dependencies, especially for the "built-in" workspace files like "coverage.WORKSPACE" or "jdk.WORKSPACE", but IMHO this is worth it.

RELNOTES: None.
PiperOrigin-RevId: 291905728