Given that we should already check the patches which we distribute, does hosting the source tree of an OSS component obligate us to check it for copyright infringement, license compliance and/or security issues?
As with anything you host publicly, you are responsible for any problem with that content. There is not much of a difference between software and other content in this case.
Depending on the country you live in, you may only be liable for violations in your hosted content once you are made aware of the issue. Also, if you host code that you received under a free license, you may be able to claim good faith.
Yes and no.
Everything under your control you can, in theory, be held responsible for. If you host code with a virus in, you are responsible for it; if it's copyright violation the same - and you can be asked to take it down.
You should always check your own code. Checking the codebase is extra work that's not strictly necessary, but if you have concerns about it then it could be worth it.
In general, the more popular the project, the better your assurance that it's problem-free.