Depends third_party/nanopb via workspace relative-path to pass bazel's dependency check.

Otherwise include "third_party/nanopb/pb.h" will find local ph.h rather than the one in "//external:nanopb".

BUILD

@@ -417,13 +417,14 @@ grpc_cc_library(
         "src/core/ext/census/grpc_context.cc",
     ],
     external_deps = [
-        "nanopb",
+        "libssl",
     ],
     language = "c++",
     public_hdrs = [
         "include/grpc/census.h",
     ],
     deps = [
+        "//third_party/nanopb",
         "grpc_base",
     ],
 )
@@ -1009,11 +1010,9 @@ grpc_cc_library(
         "src/core/ext/filters/client_channel/lb_policy/grpclb/load_balancer_api.h",
         "src/core/ext/filters/client_channel/lb_policy/grpclb/proto/grpc/lb/v1/load_balancer.pb.h",
     ],
-    external_deps = [
-        "nanopb",
-    ],
     language = "c++",
     deps = [
+        "//third_party/nanopb",
         "grpc_base",
         "grpc_client_channel",
         "grpc_resolver_fake",
@@ -1038,11 +1037,9 @@ grpc_cc_library(
         "src/core/ext/filters/client_channel/lb_policy/grpclb/load_balancer_api.h",
         "src/core/ext/filters/client_channel/lb_policy/grpclb/proto/grpc/lb/v1/load_balancer.pb.h",
     ],
-    external_deps = [
-        "nanopb",
-    ],
     language = "c++",
     deps = [
+        "//third_party/nanopb",
         "grpc_base",
         "grpc_client_channel",
         "grpc_resolver_fake",