Update bazel lockfile and check lockfile in CI (openxla#2060)

I ran `bazel build --lockfile_mode=error` and it told me to run `bazel
mod deps --lockfile_mode=update`, which led to a pretty big diff in the
lockfile. I also tried just doing `bazel build` and that leads to a
smaller diff (just the changes at the top of the file), but it seems
more prudent to do what the tool says.