proxy mirror, mirror API jobs and SBOMs take pkg:git/{host}/{path}@{commit} and cache the repository and commit in the cache /git serves, so a later clone is a cache hit, also with the upstream down. Part of #403.