Add beta Bazel JVM manifest support

[Simon (simonhj)]

Summary

Adds beta Bazel JVM SBOM support to Socket CLI.

Bazel is multi-language, but this PR starts with Bazel + Maven because many Bazel JVM repos declare Maven dependencies through rules_jvm_external in MODULE.bazel or WORKSPACE instead of committing a manifest Socket can already scan. The extractor asks Bazel what Maven artifacts it resolved, converts that into a maven_install.json-shaped manifest, and sends it through the existing scan pipeline.

What changed

• Adds socket manifest bazel [beta], a generation-only command for producing Bazel JVM SBOM manifests.
• Extends socket scan create --auto-manifest so Bazel workspaces are detected automatically and scanned through the normal scan-create flow.
• Detects Bazel workspaces via MODULE.bazel, WORKSPACE, or WORKSPACE.bazel.
• Supports Bzlmod and legacy WORKSPACE invocation modes.
• Discovers Maven repos from Bazel-visible repos / workspace metadata, including custom repo names beyond @maven.
• Parses jvm_import and aar_import rules from bazel query --output=build.
• Uses unsorted_deps.json when available as a faster structured source.
• Writes auto-manifest output under .socket-auto-manifest/maven_install.json so we do not overwrite a repo's checked-in maven_install.json.
• Adds docs, changelog entry, socket.json defaults, fixtures, and test coverage.

User flow

Generate only:

socket manifest bazel .

Generate and upload in one step:

socket scan create --auto-manifest .

Testing

Tested with unit and integration coverage for:

• Bazel binary resolution.
• Bzlmod vs legacy WORKSPACE detection.
• Bazel query argv construction.
• Maven repo discovery, including custom repo names and multi-repo cases.
• jvm_import / aar_import parsing.
• unsorted_deps.json parsing.
• Normalization into maven_install.json.
• Auto-manifest dispatch and .socket-auto-manifest/ output behavior.

Also tested against a corpus of Bazel repositories covering constructed and real-world Maven extraction cases, Bzlmod, legacy WORKSPACE, custom repo names, pinned and unpinned lockfile flows, and scan-create auto-manifest behavior.

Local checks:

git diff --check origin/v1.x
pnpm check:tsc
pnpm exec eslint --report-unused-disable-directives eslint.config.js src/commands/fix/coana-fix.mts src/commands/manifest src/commands/scan/handle-create-new-scan.mts src/commands/scan/handle-create-new-scan.test.mts src/utils/socket-json.mts vitest.config.mts
pnpm exec vitest run src/commands/manifest/bazel/bazel-bin-detect.test.mts src/commands/manifest/bazel/bazel-build-parser.test.mts src/commands/manifest/bazel/bazel-java-shim.test.mts src/commands/manifest/bazel/bazel-output-base-check.test.mts src/commands/manifest/bazel/bazel-python-shim.test.mts src/commands/manifest/bazel/bazel-query-runner.test.mts src/commands/manifest/bazel/bazel-repo-discovery.test.mts src/commands/manifest/bazel/bazel-workspace-detect.test.mts src/commands/manifest/bazel/cmd-manifest-bazel.test.mts src/commands/manifest/bazel/extract_bazel_to_maven.test.mts src/commands/manifest/bazel/generate_auto_manifest.bazel.constructed.test.mts src/commands/manifest/detect-manifest-actions.test.mts src/commands/manifest/generate_auto_manifest.test.mts src/commands/manifest/cmd-manifest.test.mts src/commands/scan/handle-create-new-scan.test.mts