[build] add Launchpad fallback for the rules_rs zlib .deb fetch

[AutomatedTester]

Problem

While setting up the Linux Rust toolchain, rules_rs (0.0.108+) downloads a
version-pinned zlib1g .deb from a single snapshot.ubuntu.com URL. That
host intermittently returns 502/503/timeouts, and because the download
happens during Bazel repository setup, a failure aborts analysis outright —
red-lining every Rust-touching job at once (Rust, Format, Ruby,
Python Selenium Manager, …), on PRs and on trunk.

This is not a regression from any one PR — it is inherent to the single-source
fetch. Recent example: a snapshot.ubuntu.com blip on 2026-09-08 failed those
jobs across trunk and open PRs simultaneously.

Fix

Add a Bazel downloader config that gives the fetch a fallback mirror.
Launchpad serves the identical, sha256-matching .deb by filename
(https://launchpad.net/ubuntu/+archive/primary/+files/<file>), so
snapshot.ubuntu.com stays the primary source and Launchpad is tried only if
it fails.

• third_party/bazel/downloader.cfg — two rewrite rules: the first re-emits
  the snapshot URL unchanged (Bazel drops the original URL once any rewrite
  matches, so this keeps it primary); the second appends the Launchpad URL.
• .bazelrc — common --downloader_config=third_party/bazel/downloader.cfg.

The download's sha256 check is unchanged, so a mirror can only ever serve the
exact expected bytes. The rewrite is version-independent (matches any
snapshot.ubuntu.com/.../*.deb), so it keeps working across future rules_rs
bumps without edits.

Validation

• Fallback proven: an isolated http_file fetch of the exact pinned deb,
  with a config that rewrites snapshot.ubuntu.com → Launchpad only
  (dropping snapshot), completes and passes Bazel's sha256 check — confirming
  the rewrite, scheme handling, and Launchpad source all work.
• No regression: bazel build //rust:selenium-manager -c opt builds and
  runs (selenium-manager 0.4.49-nightly) with the config active, no
  downloader warnings. ./scripts/format.sh --pre-push passes.

Notes

• Uses --downloader_config (Bazel 9 renamed --experimental_downloader_config).
• This supersedes the old rules_rs_zlib_snapshot.patch approach (a
  single_version_override); the downloader config needs no rules_rs patch and
  survives version bumps.