[bazel] MODULE.bazel.lock is modified when PROV_EXTS_DIR is set

Nobody has claimed this yet.

### Description

After #27433 in particular 17f8f3842dd094d92454041fb4ff3433293ac874, the repository is left dirty when compiling (most probably) anything if the environment has the `PROV_EXTS_DIR` variable set to a path.

Reproduction steps (use a proper `PROV_EXTS_DIR` path for the build to succeed, but the problem is still present with a failing build, so `/tmp` is enough to illustrate the issue):
```shell
export PROV_EXTS_DIR=/tmp
bazel build //sw/device/lib/crypto:otcrypto
git status
```

Expected output for `git status`:
```
On branch earlgrey_1.0.0
Your branch is up to date with 'origin/earlgrey_1.0.0'.

nothing to commit, working tree clean
```

Actual output for `git status`:
```
On branch earlgrey_1.0.0
Your branch is up to date with 'origin/earlgrey_1.0.0'.

Changes not staged for commit:
(use "git add ..." to update what will be committed)
(use "git restore ..." to discard changes in working directory)
modified: MODULE.bazel.lock

no changes added to commit (use "git add" and/or "git commit -a")
```

This was tested on the `earlgrey_1.0.0` branch at 27688a97d1448fa5c663724d49140590fd43b708 and the `master` branch at 14ec1a06e9a1174918f8c0fca99045e5fdc39158.

cc @jwnrt @cfrantz

Reproduce the issue with PROV_EXTS_DIR=/tmp and the bazel build //sw/device/lib/crypto:otcrypto command, then inspect the diff in MODULE.bazel.lock and compare it with PROV_EXTS_DIR unset. Trace the behavior introduced by #27433 and commit 17f8f3842dd094d92454041fb4ff3433293ac874. Done means the build no longer modifies the tracked lock file and git status reports a clean working tree.

Written by the indexing model from the issue text.