bazel: difficult to get `nogo` to ignore all third-party code

To ignore certain files in `nogo`, we need to pass in a regex to match the filename as described [here](https://github.com/bazelbuild/rules_go/blob/master/go/nogo.rst#configuring-analyzers). However, there is no one regex that allows us to reliably recognize all third-party code and match no first-party code. Ideally, this should be a "meta" thing where `nogo` can simply check what is or is not in `external` and allow configuring that directly.

Epic: CRDB-17171

Jira issue: CRDB-38733