Module metadata was being referenced directly by cloned checks.
Copy the hashes correctly (for config) and copy the metadata, but
only if the check is passive.  This means that for non-passive cloned
checks the relevant modules will create new metadata that will be
freed as the clone is dropped, but passive checks will reference shared
metadata and *not* be freed when the clone is dropped.