perf: use caching when searchig for package manifests

[jkowalleck]

currently, for each single unput, we try to find the nearest valid package manifest.
some are found multiple times, and are analyzed multiple times.

this process can be improved by using cache for candidates.
cache, whether a candidate is valid, and if it is, also cache the resulting component