Bazel: enforce strict MODULE.bazel.lock synchronization

This prevents accidental desynchronization between MODULE.bazel and
MODULE.bazel.lock by failing the build when the lockfile is out of
date, instead of silently updating it.

Enforcing strict lockfile mode ensures that such inconsistencies are
caught early and that any lockfile update is always intentional and
explicitly reviewed.

To update the lockfile explicitly, run:

  bazelisk mod deps --lockfile_mode=update

The developer documentation has not been updated, as there is currently
no Bazel build documentation available for JGit.

Test Plan
- Bump a Bazel module in MODULE.bazel (e.g. rules_java to 8.16.1).
- Do not update MODULE.bazel.lock.
- Run:
    bazelisk build org.eclipse.jgit:jgit
- The build fails as expected with an error suggesting:
    bazelisk mod deps --lockfile_mode=update

Change-Id: Icafcf359eb3f2a4a2dce16d15c9a494a2e30f7cc

.bazelrc

diff --git a/.bazelrc b/.bazelrc
index 5bf3ef8..385a71d 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -1,6 +1,6 @@
 # TODO(davido): Migrate all dependencies from WORKSPACE to MODULE.bazel
 # https://issues.gerritcodereview.com/issues/303819949
-common --enable_bzlmod
+common --enable_bzlmod --lockfile_mode=error
 common --enable_workspace
 
 build --workspace_status_command="python3 ./tools/workspace_status.py"