Those have shown to cause problems with too many concurrent downloads.
This changes kotlinc dependencies fetching to:
* use `resource/kotlinc-dependencies` if available (which is the case
for the internal repo)
* otherwise, download them from maven.
This means sha256 hashes need to be written down for bazel.
