deps: support tracked-but-implied deps and hard-fail CVE scan on missing versions

[Copilot]

bazel/deps.yaml / api/bazel/deps.yaml need to represent transitive deps that we track for CVE purposes (e.g. wasm runtime transitives like highway) without pretending they are direct deps with declared versions. This implements the schema decision from the issue discussion: tracked-implied deps become top-level metadata entries with a used_by list, disjoint from implied_untracked_deps, and a cpe without a resolvable version becomes a hard failure in the CVE pipeline rather than a silent skip.

Schema (api/bazel/external_deps.bzl)

• New used_by annotation: a top-level entry for a dep reached only transitively, carrying its own cpe/use_category/extensions, listing the tracked deps through which it is loaded.
• Clarifies implied_untracked_deps as the complementary assertion ("exists, no metadata carried") — the two namespaces must be disjoint.

Validation (tools/dependency/validate_reachability_test.py)

New check_tracked_implied_disjointness, alongside check_apparent_name_uniqueness:

• A name in any implied_untracked_deps list must not be a top-level metadata key — error names both the key and the parent: 'highway' is a tracked entry - remove it from 'v8''s implied_untracked_deps.
• Every name in a used_by list must be a top-level metadata key.

Disjointness by construction means _resolve_dep_name needs no precedence rule, and untracked→tracked promotion is atomic (the intermediate state fails).

Metadata join (bazel/BUILD)

legacy_all_repository_locations now iterates the union of version-data and metadata keys, so tracked-implied entries (no repository_locations.bzl entry) surface in the merged output for validation and CVE scanning instead of being silently dropped. Output for all existing entries is unchanged.

CVE hard-fail (tools/dependency/cve_utils.jq)

parse_deps errors when a dep declares a cpe but has no resolvable version — version-ranged matching against a missing version would make false negatives indistinguishable from "clean", the failure mode ruled out for the wasm runtimes.

highway:
  project_name: "Highway"
  cpe: "cpe:2.3:a:google:highway:*"
  used_by:
  - v8
  use_category:
  - dataplane_ext

Out of scope

• No YAML entries are migrated yet: a tracked-implied entry with a cpe will (correctly) hard-fail until dependency reachability aspect only covers the default config #46917 lands the config matrix providing resolved versions from the module graph.
• Repointing //bazel:update / //bazel:api-update at the resolved-version source belongs to that follow-up.

AI-assisted (GitHub Copilot coding agent).

• Fixes deps.yaml declares versions for deps we do not build #46916

[repokitteh-read-only]

As a reminder, PRs marked as draft will not be automatically assigned reviewers,
or be handled by maintainer-oncall triage.

Please mark your PR as ready when you want it to be reviewed!

🐱

Caused by: #46919 was opened by Copilot.

see: more, trace.