Make bazel build fully hermetic

We no longer reference @bazel_tools//third_party. All of our transitive
dependencies are now specified explicitly in our WORKSPACE file.

I also fixed the way that jar dependencies are exported, so we don't
break strict dependency checking.
-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=116421176

third_party/java/soy/BUILD

@@ -4,20 +4,20 @@ licenses(["notice"])  # Apache License 2.0
 
 java_library(
     name = "soy",
-    exports = [
+    exports = ["@soy//jar"],
+    runtime_deps = [
         "@aopalliance//jar",
         "@asm//jar",
         "@asm_analysis//jar",
         "@asm_commons//jar",
         "@asm_util//jar",
-        "@bazel_tools//third_party:guava",
-        "@bazel_tools//third_party:jsr305",
-        "@bazel_tools//third_party:jsr330_inject",
+        "@guava//jar",
         "@guice//jar",
         "@guice_assistedinject//jar",
         "@guice_multibindings//jar",
         "@icu4j//jar",
-        "@soy//jar",
+        "//third_party/java/jsr305_annotations",
+        "//third_party/java/jsr330_inject",
     ],
 )