Still not sure how to extend semantic-release/config-gitlab-bzlmod>

We _really_ need to add this to the CI

It is _very_ common to override the execution of `bazelisk`.

This means that using a `!reference` any time the `script` is
overridden to copy the run files.

Moving this to `before_script` negates that.

BREAKING CHANGE: Template no longer supports GitLab less than 16.5

The `bazelisk/template.yml` file has been removed which was required
for the CI component to be picked up on the experimental implementation
in 16.4 and less.

BREAKING CHANGE: `diff` has been removed.

Use the hermetic [`rules_diff`][rules_diff] Bazel module.

[rules_diff]: https://registry.bazel.build/modules/rules_diff

Uses a `include:local` to avoid having to copy the template for older
GitLab version support.

This makes the component include path consistent on 16.3/16.5+.

They changed the template structure from:

```
├── template.yml
├── README.md
├── .gitlab-ci.yml
├── unit/
│   └── template.yml
└── integration/
    └── template.yml
```

To:

```
├── README.md
├── .gitlab-ci.yml
└── templates/
    └── all-scans.yml
    └── secret-detection.yml
```

Unfortunately, symlinks are *not* supported so until we can drop support
for 16.3, we'll have to copy over changes.

BREAKING CHANGE: The component must be included via the `bazelisk` name.

The nameless include in `1.0.0-beta.1` is no longer supported.

```
include:
  - component: "${CI_SERVER_HOST}/ci/component/bazelisk@1.0.0-beta.1"
```

Add the `/bazelisk` named CI component:

```
include:
  - component: "${CI_SERVER_HOST}/ci/component/bazelisk/bazelisk@1.0.0-beta.2"
```

This is due to GitLab CI components being stabilised and the nameless component
support being removed.

Lukasz Okraszewski authored Jan 03, 2024 and Matthew Clarkson committed Jan 03, 2024

As of gitlab 16.5 the component dir
structure has changed. Updates the name of
component to match the updated docs.

Move off the beta version.

Pin to 7.0.0rc3 due to upstream regression
in 7.0.0rc4 onwards.

Allows the job to start straight away allowing maximum CI throughput.

Dependencies will need to be added with the `needs`[1] keyword.

[1]: https://docs.gitlab.com/ee/ci/yaml/#needs

This can be useful when setting up shared persistent caches.

We need to sort out a mirroring service for the `.deb`.

We can put them into the GitLab Package Registry.

_Eventually_, we want to be able to drive `semantic-release` from Bazel.

However, that requires hermetic resolution of `git` and `ssh` which is a
challenge that we do not have time for at this time.

`.bazelisk-script` implies everything must be a script reference.

We may want to include other references in the future.

Fragment is better nomenclature here.

BREAKING CHANGE: `.bazelisk-script` is now `.bazelisk-fragment`

Update any `!reference[.bazelisk-script, ...]` to `!reference[.bazelisk-fragment, ...]`