Add BCR downstream test script and pipeline (#2875)

Adds `bcr_downstream.py` and the `BCR Downstream Test` pipeline. The
pipeline tests whether a new BCR module version breaks the modules that
directly depend on it.

- **Trigger**: a BCR PR with the `run-downstream-test` label, or a
manual build with `TARGET_MODULE` (e.g. `protobuf@latest`). A build
tests one target module version. If a PR changes several, set
`TARGET_MODULE` to pick one.
- **Downstream modules**: the latest versions of the top 50 direct
dependents of the target, ranked by BCR PageRank
(`//tools:module_analyzer --dependents_of`).
- **Override**: each job vendors the target with `bazel vendor` and adds
`--override_module=<target>=<vendored_path>` to the downstream module's
`.bazelrc`. This covers both anonymous module and `bcr_test_module`
tasks.
- **Bazel versions**: downstream tasks use the Bazel versions in their
own `presubmit.yml`. Tasks on a major version that the target doesn't
test are skipped. If `USE_BAZEL_VERSION` is set, all tasks run with that
version instead. The target is vendored with each task's Bazel version,
or `7.x` for Bazel 6, which has no `bazel vendor`.
- **Options**: `SELECT_TOP_BCR_MODULES`, `MODULE_SELECTIONS`,
`SMOKE_TEST_PERCENTAGE`, `EXCLUDE_DEV_DEPS` and `USE_BAZEL_VERSION` can
be set as environment variables, or in lowercase under
`bcr_downstream_test` in the target's `presubmit.yml`. Environment
variables take precedence.
- **CI usage**: by default, jobs use up to 10% of machines per queue
(`CI_RESOURCE_PERCENTAGE`), in a separate
`bcr-downstream-test-queue-<queue>` concurrency group so they don't
starve `bcr-presubmit`. Job priority is -50, or -100 with the
`low-ci-priority` label.

The pipeline is added in terraform and documented in the README.

Uses `--dependents_of` from
https://github.com/bazelbuild/bazel-central-registry/pull/10649.