add a check or diff mode to `bazel mod tidy`

### Description of the feature request:

The `bazel mod tidy` tool is very useful for keeping `MODULE.bazel` up to date, but it does require developers to be disciplined enough to remember to run this or some kind of hook to make sure changes get checked in. A common pattern for ensuring files like this are up to date is to use a check or diff mode which prints changes it would make and exits with an error status code. Gazelle for example has `gazelle -mode diff` which makes no changes on disk and prints them as a diff instead.

A similar feature for `bazel mod tidy` would be very useful (especially since one common use is to run it right after gazelle).

### Which category does this issue belong to?

`bzlmod`

### What underlying problem are you trying to solve with this feature?

We would like to add a CI check that fails if `MODULE.bazel` has not been updated with `bazel mod tidy` correctly.

### Which operating system are you running Bazel on?

Linux

### What is the output of `bazel info release`?

release 7.4.0

### If `bazel info release` returns `development version` or `(@non-git)`, tell us how you built Bazel.

_No response_

### What's the output of `git remote get-url origin; git rev-parse HEAD` ?

_No response_

### Have you found anything relevant by searching the web?

I've tried to look through bazel issues and the docs for `bazel mod tidy` and don't see anything like this.

### Any other information, logs, or outputs that you want to share?

_No response_

Start at the `bazel mod tidy` command entry point and trace how it updates `MODULE.bazel`. Review nearby command tests and the existing tidy output behavior, then define coverage for a mode that leaves files unchanged, prints a diff, and returns a failing status when updates are needed.

Written by the indexing model from the issue text.