normalize/remove protocols on GIT repos

[michaelkedar]

e.g. CVE-2017-15650 uses http://git.musl-libc.org/git/musl while CVE-2025-26519 uses https://git.musl-libc.org/git/musl
(I think we also have records that use git:// or don't have the protocol at all)

Doing an API query by tag will only match if the protocol matches exactly.

We should probably remove the protocol when we're matching against repos to allow us to match these.

[michaelkedar]

Note: #3903 (comment)