Fix #6372

This adds the package to REQUIRE on `Pkg.clone()` if it exists in METADATA. This means that calling `Pkg.clone()` on a repo that's on an old tag will result in the package getting updated to the latest release, but that seemed preferable to making `Pkg.clone()` on a package that's on a tag result in a pinned package.