Use rules_jvm_external to manage Bazel's third_party Java dependencies

Once https://github.com/bazelbuild/rules_jvm_external/pull/169 is merged, rules_jvm_external will be able to resolve Maven dependencies transitively using maven_install.json, a pinned list of transitive artifacts. This file is generated with an initial call to Coursier via rules_jvm_external. Subsequent calls will use http_file with sha256 checksums to verify integrity and take advantage of Bazel’s repository cache.

Benefit 1: No need to vendor jars in third_party. Instead, one can just update the maven_install declaration in the WORKSPACE file with new artifacts / versions, and check in the updated maven_install.json file. Contributions touching third_party no longer need to be split up into two changes (third_party and non-third_party).

Benefit 2: No need for Bazel maintainers to manually wire up transitive dependencies in third_party. rules_jvm_external will resolve and fetch artifacts from Maven into $output_base/external/@maven with a fully wired up BUILD file. The missing piece is a post-build step to vendor that directory back into Bazel’s source tree.

Benefit 3: Maintaining capability for fully offline builds, since artifact downloads will be managed by Bazel and can be integrated with the distdir in a straightforward manner.

[buchgr]

Is the SHA256 checksum of a dependency a sufficient representation for the dependency itself?

The last few times we talked about this it was not …

Correct. The files would be generated into $output_base/external, but we can copy it back into the source tree.

I have actually also wanted to do this already after I first found about the rules_jvm_external. I believe this alone would already be a HUGE win.

[jin]

The last few times we talked about this it was not …

Fair enough. I have a PR that allows rules_jvm_external to write directly into a source tree and use the new workspace.managed_directories feature: https://github.com/bazelbuild/rules_jvm_external/pull/168