Fix sq module bzlmod resolution: invalid crate.annotation, wrong-crate features, and non-hermetic crypto backend

[Copilot]

Consuming sq via bzlmod failed at analysis with unknown attribute default_features provided on crate.annotation — that attribute (and features) doesn't exist on crate_universe's bzlmod annotation tag, only crate_features does. The crypto features were also attached to the wrong crate, and the overlay BUILD.bazel depended on a target crate_universe never generates.

MODULE.bazel

• Replaced the invalid crate.annotation(default_features = False, features = [...]) on sequoia-sq with crate.annotation(crate = "sequoia-openpgp", crate_features = [...]) — crypto-rust/allow-experimental-crypto/allow-variable-time-crypto are sequoia-openpgp features that sequoia-sq merely forwards.
• Dropped unused bazel_deps on bazel_skylib and rules_cc (not referenced directly; already transitive via rules_rust).

overlay/BUILD.bazel

• sequoia-sq is the workspace-root package being indexed, not a crate crate_universe generates a target for — switched deps = ["@sequoia_sq_crate_index//:sequoia-sq"] to all_crate_deps() / aliases() from @sequoia_sq_crate_index//:defs.bzl.
• Added compile_data = ["README.md"] since src/main.rs does include_str!("../README.md").

Crypto backend

crate.annotation can't disable default features, and upstream's default (crypto-nettle) pulls nettle-sys, requiring a system Nettle/GMP install — non-hermetic. Added patches/sq-default-crypto-rust.patch flipping sequoia-sq's Cargo.toml:

 [features]
 default = [
-    "crypto-nettle",
+    "crypto-rust",
 ]

registered in source.json (patch_strip: 1 + sha256). Verified nettle/nettle-sys no longer appear anywhere in deps(@sq//:sq).

source.json

Recomputed the overlay hash for the changed BUILD.bazel and added the new patch entry; url/integrity/strip_prefix untouched.

---

Known follow-up (not addressed here): a transitive dependency, sequoia-keystore-backend, has a build.rs that bakes build-script-local absolute paths into generated sources via include_bytes!; those paths don't survive into the crate's own compile action under Bazel's per-action sandboxing, so a full bazel build @sq//:sq still fails deeper in the graph. This is a pre-existing upstream/Bazel-compatibility issue, unrelated to the crate.annotation/feature/overlay problems fixed here.