[aignas]

When a hub is created from a uv.lock file, wire the package dependencies
in the hub from the uv.lock dependency graph instead of the wheel
METADATA.

parse_requirements renders the dependency edges of each uv.lock entry
as PEP 508 requirements, keeping the extras and the markers of the edges.
The optional dependencies of a package are included only for the extras
that its dependents request. The hub_builder collects them per hub and
drops the edges to packages that are not in the hub, e.g. ones only used
on other platforms. The hub_repository passes them to pkg_aliases as
requires_dist, which then creates the pkg and whl targets in the
hub, and the members of a dependency group as group_deps.

The hub keeps using the wheel METADATA for a package when:

• the hub comes from requirements files, so their output is unchanged;
• the uv.lock entries of the package that are used on the target
  platforms have different dependencies, e.g. forks per Python version;
• the dependencies differ between the pip.parse calls for different
  Python versions of the same hub;
• the package has no dependencies in the hub.

This threads the dependencies through the existing pkg_aliases
support (#4105) instead of passing them to the whl_deps_repo as inline
metadata, because the hub then owns the dependency graph and the
per-package repos are only needed for the sources. pkg_aliases is
fixed to create the _pkg and _whl group implementation targets and
to pass the rules it needs, as this code path was only used with mocks.

Follow-ups:

• Point the hub whl_map directly at the shared extracted wheel repos
  for the packages with known dependencies and skip creating their
  whl_deps_repo. This needs pkg_aliases to also create the targets
  for packages without dependencies.
• Combine the dependencies of forked uv.lock entries using their
  resolution-markers instead of falling back to METADATA.
• WORKSPACE pip_parse with uv_lock still uses the wheel METADATA.

Stacked on #3856.