Fix the Bazel build re/nanopb

This change modifies the BUILD rule dependencies used for nanopb,
switching them from third_party to //external -- the former uses
submodules, which don't work well with Bazel (since Bazel removes
submodules from repositories as it fetches them, preferring instead to
unify submodule versions across the workspace via the top-level
WORKSPACE configuration).