It's useful to fetch just git repos, but not distfiles. It's useful when
fetching all repositories, but fetching actual files only when building.
Especially saves a lot of space from kernel tarballs.

And also, useful when using builder just to verify sources.

QubesOS/qubes-issues#9662

Do not override the whole env, just add/replace GNUPGHOME env. This is
especially for subprocess to find git or gpg using PATH variable.
And also use /usr/bin/env python3 in shebang (similarly to the main
qubesbuilder-cli script), do not assume /usr/bin/python3.

If there is no need to use sudo (most of the cases), don't try it. This
avoids polluting logs if sudo is not allowed, or even not installed.

There is --git-commit option for get-and-verify-source.py already. Use
its implementation, but keep verifying tags. For that, they need to be
fetched.

Scheduled pipelines on the "main" branch have cache jobs enabled, and
those jobs are used by more or less all pipelines in other repos for
quicker run.
Do this for ordinary "main" pipelines too, otherwise all jobs won't use
a cache for a week after merging anything to the builderv2 repo.