deps.yaml declares versions for deps we do not build

*Title*: deps.yaml declares versions for deps we do not build

*Description*:

`bazel/deps.yaml` (and `api/bazel/deps.yaml`) carry `version`/`urls`/`sha256` for entries that are not necessarily present in any build we actually perform. A declared version is a claim about a build that may not be the one being done — for `select`-gated deps it is simply wrong in the configurations where the dep is not linked, and under bzlmod it can drift from what the module graph actually resolves.

These entries have historically been kept specifically for CVE scanning. That matters most for deps like the wasm runtimes, which see continual CVEs and are not monitored upstream, so any change here must not silently reduce CVE coverage.

Surfaced while working on #46875, where the `legacy_all_repository_locations` jq join in `bazel/BUILD` had to be reworked purely to reunite metadata with version data that is arguably fictional.

Two candidate directions discussed:

1. Force the deps to be present so the declared versions are real — e.g. by ensuring they load such that resolution actually pins them.
2. Accept transitive versions from the resolved module graph, and extend the CVE checker to handle named transitives, so `deps.yaml` carries only `cpe` and project metadata while versions come from what was actually built.

Constraints on any solution:

- CVE matching is version-ranged (`tools/dependency/cve_matcher.jq` via `version.jq`). Attributing a transitive's CPE to a parent entry without its own version produces meaningless matches — false negatives look identical to "clean", which is the failure mode we cannot accept for the wasm runtimes.
- Any dep carrying a `cpe` but lacking a resolvable version must be a hard failure in the CVE pipeline, not a skip.
- `//bazel:update` and `//bazel:api-update` write back to `repository_locations.bzl` via the `updater` rule and will need repointing at whatever becomes the version source.
- Coverage becomes a union over configurations, which ties into the reachability config work.

[optional *Relevant Links*:]

- https://github.com/envoyproxy/envoy/pull/46875
- https://github.com/envoyproxy/envoy/pull/42890
- `bazel/BUILD` — `legacy_all_repository_locations`
- `tools/dependency/BUILD` — `cpe-dependencies`, `cves`, `cves-scanned`
- `tools/dependency/cve_matcher.jq`, `tools/dependency/version.jq`