.npmignore isn't respected for git repos

This fixes #6400. Replaces `git archive` + `addLocalTarball()`  with `git clone && git checkout` + `addLocal()`, which ensures that all of the `npm pack` rules aren't circumvented and `.npmignore` exclusions are applied (among other things). Includes two tests: one to ensure that caching an ordinary (git checkout) directory (still) works, and another to ensure that caching a git repo works correctly.

/cc @iarna for review, who should tell me if I'm using `realizePackageSpecifier()` correctly.