update/patch: avoid applying patches directly in build repos

Switching branches and applying patches in the build repos will
unnecessarily touch many files, causing rebuilds of packages that didn't
really change; furthermore, it is filling the reflog with many entries.

Don't ever switch to base branch in the build repos and apply patches in
a temporary clone to avoid these issues.

In addition, GPG signing is generally disabled in the build repos to
override potential global configuration (as signing doesn't make sense and
will slow down rebases).