Macaron pull the latest when analyzing a local cloned repository

[tromai]

Description
When analyzing a locally cloned repository, by default, if the user doesn't provide the branch name or the commit digest, Macaron will try to analyze the latest commit of the default branch. However, to analyze the latest commit, Macaron performs a git pull -f --ff-only which will fetch from the remote repository. This is not as expected as the reason we have the local repo feature is to analyze repositories that Macaron couldn't access (behind SSO, internal repos, etc.).
Note that we should only not fetch from remote for the main target but not for the dependencies.