Status: in limbo, see T725.
We currently use external Bazel repositories/workspaces, defined in third_party/go/repositories.bzl. These are currently generated by a hack in third_party/go/gazelle-deps.sh, based on constraints defined within that same script.
If you need to add a dependency, edit gazelle-deps.sh and add your dependency there long the others. To quickly iterate, place it on the top before an exit 0 statement, then once verified move it to an appropriate position within the list and re-run the script one last time to ensure the generates repositories.bzl is up to date with gazelle-deps.sh.