Fix #6372

This adds the package to REQUIRE on Pkg.clone() if it exists in
METADATA. This means that calling Pkg.clone() on a repo that's on an
old tag will result in the package getting updated to the latest
release, but that seemed preferable to making Pkg.clone() on a package
that's on a tag result in a pinned package.