gitproto: disable HTTP keep-alives on the default transport

Use a cloned http.Transport with DisableKeepAlives=true as the git-sync default, instead of returning the package-level http.DefaultTransport.

Two changes in one:

1. Always clone — previously, NewHTTPTransport(false) returned the shared http.DefaultTransport, so any TLS or pool settings we added would leak into other code in the same process. The library angle makes that a real footgun.

2. Keep-alives off — git-sync's HTTP workflow against a given host is coarse-grained (one info/refs GET, then one upload-pack or receive-pack POST) with real work in between (planning, source fetch, local object materialization). On the push side the gap is long enough for CDN edges and some hosted git providers to close their end of an idle TLS socket; the next POST then fails with "use of closed network connection" because the pooled connection is half-dead. Observed against Cloudflare Artifacts after a ~13s gap.

Pool reuse would save at most one TLS handshake per sync, negligible against multi-MB to multi-GB transfers, so a fresh connection per request is the right trade. Library callers needing pool reuse can pass their own RoundTripper to NewHTTPConn.