Support `dev_dependency = True` in Bazel consumers

[a-zw]

What

Modules using score_docs_as_code as a Bazel dev-dependency (dev_dependency = True)
break downstream docs_combo builds.
The //:sourcelinks_json target is a genrule that depends on
@score_docs_as_code//scripts_bazel:generate_sourcelinks,
which Bazel doesn't propagate transitively for dev-dependencies.

:sourcelinks_json is the only problematic target.
:docs_sources is a plain filegroup (no tooling dep) and :needs_json is only
consumed locally — neither breaks when score_docs_as_code is a dev-dep.

Acceptance Criteria (DoD)

1. A module with bazel_dep(name = "score_docs_as_code", dev_dependency = True) can
   successfully build its own //:docs and //:needs_json targets.
2. A root module (reference integration) can run //:docs_combo that includes such a dev-dep module's
   :needs_json in its data, without build errors.
3. //:sourcelinks_json is no longer a public target; //:scan_code_sources is
   the public interface for source-link inputs.
4. Existing consumers that depend on @dep//:sourcelinks_json continue to work
   (backwards compatibility).

How

Proposed solution

Instead of depending on @dep//:sourcelinks_json (pre-built genrule),
depend on @dep//:scan_code_sources (plain filegroup of source files).
The root module runs the sourcelinks genrule itself,
where score_docs_as_code is a regular dependency.

Changes in docs.bzl

• Add a //:scan_code_sources filegroup exposing the scan_code inputs publicly.
• Make //:sourcelinks_json visibility private.
• Extend docs() to accept source filegroups from dependencies
  and generate sourcelinks for them locally.
• Merge as before via _merge_sourcelinks().

Migration

• Dependencies expose //:scan_code_sources.
• Root modules pass source files alongside :needs_json labels.
• Backwards-compatible: old :sourcelinks_json targets can remain until consumers migrate.