chore: rules_go is a non-dev dep at HEAD

[alexeagle]

This ensures if a bzlmod user were to fetch bazel-lib with a SHA or a git_repository, they don't need to patch our repo (similar to how CI was doing it) in order to build the tools/ from head

[kormide]

Would be nice if we could generate the patch and use a write_source_files to keep it updated. Otherwise we'll only know it failed when the BCR release fails. If that proves difficult to do, perhaps it's a good motivation for publish-to-bcr to support a regex replace like you originally suggested 🤔

[alexeagle]

I'll just add a CI step that runs patch -p1 < .bcr/patches/* to catch that on CI without adding complexity