Investigate using `managed_directories` for `spago` dependencies

[Hardy Jones]

Much like how rules_nodejs uses managed_directories for npm/yarn dependencies,
we ought to be able to use managed_directories to make working with spago be more correct.

Right now, the spago dependencies are expected to be managed out of system.
This is error-prone and likely to cause issues.
If we can have the dependencies be managed by bazel,
it ought to make sure everything is always up to date and builds are more correct.
It also should mean that the spago dependencies could remain in external repositories (as they belong).