build: fix Bazel lzma-sys wiring (#16634)

This seems to be required to fix bazel builds on an applied devbox

## Summary
- add the Bazel `xz` module
- wire `lzma-sys` directly to `@xz//:lzma` and disable its build script
- refresh `MODULE.bazel.lock`

## Validation
- `just bazel-lock-update`
- `just bazel-lock-check`
- `bazel run //codex-rs/cli:codex --run_under="cd $PWD &&" -- --version`
- `just bazel-codex --version`

Co-authored-by: Codex <noreply@openai.com>

MODULE.bazel

@@ -234,14 +234,18 @@ crate.annotation(
 
 inject_repo(crate, "zlib")
 
-# TODO(zbarsky): Enable annotation after fixing windows arm64 builds.
+bazel_dep(name = "xz", version = "5.4.5.bcr.8")
+
 crate.annotation(
     crate = "lzma-sys",
-    gen_build_script = "on",
+    gen_build_script = "off",
+    deps = ["@xz//:lzma"],
 )
 
 bazel_dep(name = "openssl", version = "3.5.4.bcr.0")
 
+inject_repo(crate, "xz")
+
 crate.annotation(
     build_script_data = [
         "@openssl//:gen_dir",