Commit MODULE.bazel.lock files (#4484) **What type of PR is this?** > Other **What does this PR do? Why is it needed?** This ensures rules_go developers always see the same bits when downloading files. We should see a security error if a module version changes upstream. **Which issues(s) does this PR fix?** Fixes #4483 **Other notes for review**