It seems one can only specify a single URL in the lock file. So the tools are always fetched from the internet. I'd really prefer mirroring the files and archives on a CI-internal server and only have the internet as a fallback.
I think an API similar to that of the BCR would be applicable here as well. That is, adding an optional mirror_urls field to the lock file, or a global, top-level mirrors field, or both.
Have you considered something like this and would you be interested in the feature?