jax

aadc9978 - [CI] Add `bcr.bazel.build` fallback mirrors to `bazel_downloader.cfg` and pass `bazel_dns_windows.security` in `ci/build_artifacts.sh`.

[CI] Add `bcr.bazel.build` fallback mirrors to `bazel_downloader.cfg` and pass `bazel_dns_windows.security` in `ci/build_artifacts.sh`. Bazel's `HttpConnector` treats `java.net.UnknownHostException` as an `UnrecoverableHttpException` and aborts a single URL on the first attempt without entering its retry loop, even when JVM negative DNS caching is shortened. However, `HttpConnectorMultiplexer` still fails over across rewritten candidate URLs configured via `--experimental_downloader_config`. Add `bcr.bazel.build` fallback rewrites (`storage.googleapis.com/bcr.bazel.build` and `raw.githubusercontent.com/bazelbuild/bazel-central-registry/main`) to `bazel_downloader.cfg` so Bzlmod registry fetches can fail over to alternate hostnames during transient DNS or CDN hiccups. Also pass `--host_jvm_args=-Djava.security.properties=file:///$workspace_path/ci/bazel_dns_windows.security` on Windows in `ci/build_artifacts.sh` (matching `ci/run_bazel_test_cpu_rbe.sh`) so Windows wheel builds also apply the JVM DNS cache tuning for RBE connections. PiperOrigin-RevId: 998132793