[codex] Preserve build-script dependencies in rules_rs annotations (#27322)

## Why

Bazel compiles Cargo build scripts in the exec configuration. For
`openssl-sys`, that means the target-specific optional `openssl-src`
dependency can disappear when producing musl release binaries, even
though the build script still needs the vendored source crate.

## What changed

Patch `rules_rs` to expose its existing unconditional
`build_script_deps` input through `crate.annotation`, then annotate
`openssl-sys` with the pinned `openssl-src` target. Target-derived build
dependencies continue to use the existing selected dependency path.

## Validation

- `just bazel-lock-check`

Stack: 2 of 6. Follows #27321.

MODULE.bazel

@@ -94,6 +94,7 @@ single_version_override(
     module_name = "rules_rs",
     patch_strip = 1,
     patches = [
+        "//patches:rules_rs_build_script_deps_annotation.patch",
         "//patches:rules_rs_windows_gnullvm_exec.patch",
         "//patches:rules_rs_windows_exec_linker.patch",
     ],
@@ -295,6 +296,11 @@ bazel_dep(name = "openssl", version = "3.5.4.bcr.0")
 inject_repo(crate, "xz")
 
 crate.annotation(
+    # Build scripts compile in Bazel's exec configuration, so target-specific
+    # optional build deps are otherwise dropped for the musl release platforms.
+    build_script_deps = [
+        "@crates//:openssl-src-300.5.5+3.5.5",
+    ],
     build_script_data = [
         "@openssl//:gen_dir",
     ],