`@unpinned_maven//:pin` caching md5 checksum of artifacts such that it cannot be cleared using `bazel clean --expunge`

I've come across an issue with `@unpinned_maven//:pin` where the generated JSON in the `pin` script has the wrong checksum for an artifact that I had to replace in my repository. I have a private maven repository that had a jar file that was incorrectly added. It was deleted and re-uploaded to the private nexus.

After doing this, running `bazel run @maven//:pin` will generate the correct lock file with the correct checksums and metadata for the new version of the artifact but running `bazel run @unpinned_maven//:pin`

Hard deleting bazel's `output_base` directory and running `bazel clean --expunge` do not resolve the issue, so the metadata must be cached somewhere else.

Start by tracing the @unpinned_maven//:pin and @maven//:pin entry points and compare the generated JSON and lock-file metadata after replacing an artifact. Check whether the checksum persists after deleting output_base and running bazel clean --expunge. Done means the pin command regenerates the correct checksum for the replacement artifact without hidden cached metadata.

Written by the indexing model from the issue text.