Copy-Based Reuse and its Implications in Open Source Software Supply Chains