Upstream: https://we.phorge.it/T15780
Since T330797 we do not use Phabricator Differential anymore for code review.
Since T191182 we do not host any repositories canonically anymore in Phabricator Diffusion - all repositories are mirrored into Diffusion from another place (Gerrit, GitHub, GitLab, etc) where code development actually takes place outside of Phabricator.
Clicking on the "Clone" button in a Diffusion repository, it makes sense not encourage folks to clone code repositories from Phabricator Diffusion but instead from the canonical code repository location: That would allow developers to do developer stuff (proposing changes via pushing custom branches etc) on their journey into a bright development contribution future.
Implementing this would also hide/fix T347408: Do not expose dead git-ssh.wikimedia.org service as repo Clone URLs (defined in diffusion.ssh-host setting) and T347476: Set security.require-https to true on the user side (though not really T244907: Reduce the number of six default URIs in Diffusion on the management side).
It would still be possible to clone from Diffusion (needed until non-public {T213246} and T349921: integration-agent-docker machines excessively pull some Wikibase related Git repos in Diffusion get resolved) - the repository URIs provided by Diffusion itself would just not be advertised anymore via the "Clone" button in Diffusion's repository web view.
Wondering whether this should go along with some diffusion.disallow-cloning-observed-repositories setting or if my argumentation is... convincing™.