Support updating oci artifacts in bzlmod (rules_oci oci.pull)

[rarkins]

Discussed in #31895

^{Originally posted by punsoong-canva October 10, 2024}

Tell us more.

Renovate already supports updating dependencies pulled in with rules_oci and oci_pull in legacy WORKSPACE files (https://docs.renovatebot.com/bazel/#legacy-workspace-files)

Similar to #27467, I would like Renovate to support updating oci artifacts when oci_pull is being called from a module extension in a MODULE.bazel file.
From: https://github.com/bazel-contrib/rules_oci/blob/main/docs/pull.md

 oci = use_extension("@rules_oci//oci:extensions.bzl", "oci")

# A multi-arch base image with variants, note that it won't work with just "linux/arm64"
oci.pull(
    name = "distroless_base_nossl_debian12",
    digest = "sha256:73c3d3f3030516665c916ebc9baa80f89c1a90e438dc02f1fed525ed246c0c2a",
    image = "gcr.io/distroless/base-nossl-debian12",
    platforms = [
        "linux/amd64",
        "linux/arm64/v8",
    ],
)
...
```</div>

Reproduction: https://github.com/renovate-reproductions/31895