Make bazel build fully hermetic

We no longer reference @bazel_tools//third_party. All of our transitive
dependencies are now specified explicitly in our WORKSPACE file.

I also fixed the way that jar dependencies are exported, so we don't
break strict dependency checking.
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=116421176

third_party/java/junit/BUILD

@@ -5,5 +5,8 @@ licenses(["reciprocal"])  # Common Public License 1.0
 java_library(
     name = "junit",
     testonly = 1,
-    exports = ["@bazel_tools//third_party:junit4"],
+    exports = [
+        "@hamcrest_core//jar",
+        "@junit//jar",
+    ],
 )