perf: speed up org-wide sweeps and the e2e suite - #10706

The clean stage ran CleanAction for every pipeline, although the
pipelines an autodiscovery generates for one repository share a working
branch, hence one pull request. On a 2,125-pipeline sweep that meant
about 2,100 cleanups of some 45 pull requests, an extrapolated 13,000
GraphQL queries, none of them logged.

Actions now expose a cleanup key, and the engine cleans each key once,
skipping keys published to during this execution.

Signed-off-by: Loïs Postula <lois@postu.la>

Checkout ran before every source, condition and target, and pulled each
time: 0.3-0.9s per checkout on public repositories, and most of the
162-minute pipeline stage of a 2,125-pipeline sweep, which went down to
78 minutes.

The pull sets no reference, so go-git only fast-forwards the branch to
the remote default branch. The working branch only changes during an
execution through Updatecli's own pushes, which start from the local
branch, and API commits, which pull the branch themselves.

Signed-off-by: Loïs Postula <lois@postu.la>

Every manifest using a githubsearch scm runs one search query, then one
query per repository found to list its branches. Manifests of a compose
file or a policy usually share the same search, so the same queries ran
once per manifest: config loading of a 45-repository sweep went from
16.6 minutes to 42 seconds once they ran once.

Query results are now kept for the execution, per credentials and query.

Signed-off-by: Loïs Postula <lois@postu.la>

After cloning, every ref of the remote was fetched with refs/*:refs/*.
On GitHub that includes the refs/pull/* kept for every pull request
ever opened, with their objects, although nothing in Updatecli reads
them. githubsearch has no singleBranch setting, so every repository it
discovers goes through this fetch.

Fetching refs/heads/* and refs/tags/* keeps the local branches and tags
the fetch was meant for. Cloning with go-git, two runs each:

  updatecli/updatecli (10,081 pull refs): 11.4-11.7s, 133M -> 3.8-4.0s, 14M
  updatecli/website (3,791 pull refs): 20.2-20.6s, 55M -> 11.9-12.2s, 19M
  updatecli/policies (247 pull refs): 1.7-2.2s, 3.5M -> 1.1-1.2s, 1.1M

Signed-off-by: Loïs Postula <lois@postu.la>

Every action an autodiscovery finds gets conditions checking whether its
reference is a tag, a branch or a release. The tag and branch checks
cloned the action's repository: 718 MB for github/codeql-action, 262s to
learn that "v3" isn't a branch. The 43 action pipelines of the e2e suite
were 65% of its pipeline stage; with ls-remote the suite takes 46% less.

Generated manifests now use ls-remote for the conditions and the digest
sources, and for the version sources unless they use "latest", which
depends on dates, or an age filter. gitbranch gains the "lsremote"
option gittag has.

gittag's ls-remote listing now returns the commit an annotated tag points
to, like its local listing, instead of the tag object, which would have
pinned actions to the wrong hash.

Signed-off-by: Loïs Postula <lois@postu.la>