Use `bazel mod deps` to update lockfile (#2744)

Can't rely on `bazel build --nobuild` since not all of the requisite
module extensions are dumped into the lockfile for whatever reason.