MODULE.bazel depends on a bad protobuf version (for Java)

MODULE.bazel is using protobuf 27.0-rc2 and disagrees with bazel/repository_locations.bzl which uses 21.5. For starters, why use an RC version?

Protobuf versions after 23.x start a new major version in Java to 4.x. However, the ecosystem is blocked on https://github.com/protocolbuffers/protobuf/issues/17247 before they can upgrade. Yes, you build from source with Bazel, but Bazel in Java still pulls many things from Maven Central (via maven_install) and so could have been compiled with older versions of protobuf, and thus be incompatible with 27.0-rc2.

In grpc-java we were trying to swap to xds from BCR, but noticed the newer protobuf, which means we can't upgrade as it is simply too dangerous/confusing to users. I'm happy to see #96, but it seems the versions should become somewhat aligned with repository_locations.bzl and protobuf downgraded to 21.7.

I looked through the transitive dependencies, and didn't see any that used such a new protobuf version. But I didn't actually try a build to verify.

CC @keith, @sergiitk