[bazel] MODULE.bazel.lock is modified when PROV_EXTS_DIR is set

[ia0]

Description

After #27433 in particular 17f8f38, the repository is left dirty when compiling (most probably) anything if the environment has the PROV_EXTS_DIR variable set to a path.

Reproduction steps (use a proper PROV_EXTS_DIR path for the build to succeed, but the problem is still present with a failing build, so /tmp is enough to illustrate the issue):

export PROV_EXTS_DIR=/tmp
bazel build //sw/device/lib/crypto:otcrypto
git status

Expected output for git status:

On branch earlgrey_1.0.0
Your branch is up to date with 'origin/earlgrey_1.0.0'.

nothing to commit, working tree clean

Actual output for git status:

On branch earlgrey_1.0.0
Your branch is up to date with 'origin/earlgrey_1.0.0'.

Changes not staged for commit:
  (use "git add <file>..." to update what will be committed)
  (use "git restore <file>..." to discard changes in working directory)
	modified:   MODULE.bazel.lock

no changes added to commit (use "git add" and/or "git commit -a")

This was tested on the earlgrey_1.0.0 branch at 27688a9 and the master branch at 14ec1a0.

cc @jwnrt @cfrantz