External repositories: disallow use of unexported repository rules

Treat repository rules the same way as build rules: they may only be used,
if exported by a Skylark file. It has never been intended to create external
repositories by anonymous rules, and, in fact, for properly recording resolved
information, it is necessary that all repository rules used can be referred
to by an accessible name.

Change-Id: Ib9259d58be66b033721a6f591656c45889f49931
PiperOrigin-RevId: 204872735