db: cache SCM instance short-term (tied to SQLAlchemy session lifetime)

Repeatedly checking whether SCM instances are invalidated is slow, and
we don't actually _want_ SCM instances to invalidate half-way through
a request either.

Therefore cache them in on the db.Repository object, the lifetime
of which is directly tied to the lifetime of the SQLAlchemy session,
the lifetime of which is tied directly to the individual HTTP request.
This way, we only check for invalidation the first time the SCM instance
is accessed in a request.

This will improve performance in cases where we have (by definition) badly
written code that retrieves repo objects several times.