--lockfile_mode try-refresh

### Description of the feature request:

It would be useful to introduce an additional `--lockfile_mode` option, something like `try-refresh`. In this mode, Bazel would attempt to refresh dependencies, but if it fails (for example, due to lack of network access), it would simply skip the refresh and proceed with the build as usual.

### Which category does this issue belong to?

Core, Local Execution, External Dependency

### What underlying problem are you trying to solve with this feature?

I’d like a way to update the `MODULE.bazel.lock` file in environments where network access isn’t always available. Currently, I’m using the `bazel vendor` command to generate a vendor directory, but it would be helpful if the lockfile update process could gracefully handle intermittent or missing network connectivity.

### Which operating system are you running Bazel on?

Linux

### What is the output of `bazel info release`?

release 8.5.0- (@non-git)

### If `bazel info release` returns `development version` or `(@non-git)`, tell us how you built Bazel.

Nixos

### What's the output of `git remote get-url origin; git rev-parse HEAD` ?

```text

```

### Have you found anything relevant by searching the web?

_No response_

### Any other information, logs, or outputs that you want to share?

_No response_

Read the existing --lockfile_mode handling and the MODULE.bazel.lock update flow; the issue does not identify source files or tests, so locate the relevant command entry point first. Compare it with bazel vendor behavior and define coverage showing that a failed refresh proceeds without blocking the build.

Written by the indexing model from the issue text.