clone_url: use regexp and single pass for variable expansion - avoid nested expansion in case a variable value would contain a variable reference

It would probably never be a problem in real life, but just avoid the tech debt
of doing it wrong ...