Follow-up from "Defer workspace source commits"

The following discussion from !1628 (merged) should be addressed:

• @juergbi started a discussion: (+2 comments)

  We no longer use sourcecache itself anymore, as far as I can tell. I'd suggest replacing the above with cas = self._get_context().get_cascache().

• workspace plugin should not access private API
• rework central source handling to resolve the issues identified by workspaces:

  we need to set the _key property of that source before we do any caching so we can accurately ref distinct trees and we need to allow logic for the workspace possibly not being cached in the usual workflow since it essentially is not if it has diverged from the checkout state