fietsje: implement .replace, add Cilium dependencies.

The new .replace() can be used to mirror 'replace' stanzas in go.mod,
and that's what it's being used for in Cilium, as it ships a handful of
forked libraries that we have to pull in.

The Cilium targets are currently unused, but the ones confirmed to build
are:

 - @com_github_cilium_cilium//cilium: cilium API client
 - @com_github_cilium_cilium//daemon:daemon: cilium daemon/agent
 - @com_github_cilium_cilium//operator: cilium operator

These currently built as dynamic libraries - turning them into
static/pure builds will come in a later build.

Test Plan: how do we test this? :)

X-Origin-Diff: phab/D542
GitOrigin-RevId: b38c7c1d0be8b0b88ea8f6992c9c5557189399cc
diff --git a/build/fietsje/dependency.go b/build/fietsje/dependency.go
index c6100e4..e12e272 100644
--- a/build/fietsje/dependency.go
+++ b/build/fietsje/dependency.go
@@ -44,9 +44,22 @@
 	shelf *shelf
 
 	// Build specific settings passed to gazelle.
-	disableProtoBuild bool
-	buildTags         []string
-	patches           []string
+	disableProtoBuild    bool
+	forceBazelGeneration bool
+	buildTags            []string
+	patches              []string
+	buildExtraArgs       []string
+	// replace is an importpath that this dependency will replace. If this is set, this dependency will be visible
+	// in the build as 'importpath', but downloaded at 'replace'/'version'. This might be slighly confusing, but
+	// follows the semantics of what Gazelle exposes via 'replace' in 'go_repository'.
+	replace string
+}
+
+func (d *dependency) remoteImportpath() string {
+	if d.replace != "" {
+		return d.replace
+	}
+	return d.importpath
 }
 
 // locked is information about a dependency resolved from the go module system. It is expensive to get, and as such
@@ -73,6 +86,9 @@
 }
 
 func (d *dependency) String() string {
+	if d.replace != "" {
+		return fmt.Sprintf("%s@%s (replacing %s)", d.replace, d.version, d.importpath)
+	}
 	return fmt.Sprintf("%s@%s", d.importpath, d.version)
 }
 
@@ -86,7 +102,7 @@
 	}
 
 	// If already locked in the shelf, use that.
-	if shelved := d.shelf.get(d.importpath, d.version); shelved != nil {
+	if shelved := d.shelf.get(d.remoteImportpath(), d.version); shelved != nil {
 		d.locked = shelved
 		return nil
 	}
@@ -115,7 +131,7 @@
 	log.Printf("%s: locked to %s", d, d.locked)
 
 	// Save locked version to shelf.
-	d.shelf.put(d.importpath, d.version, d.locked)
+	d.shelf.put(d.remoteImportpath(), d.version, d.locked)
 	return d.shelf.save()
 }
 
@@ -133,7 +149,7 @@
 	}
 	goTool := filepath.Join(goroot, "bin", "go")
 
-	query := fmt.Sprintf("%s@%s", d.importpath, d.version)
+	query := fmt.Sprintf("%s@%s", d.remoteImportpath(), d.version)
 	cmd := exec.Command(goTool, "mod", "download", "-json", "--", query)
 	out, err := cmd.Output()
 	if err != nil {