Require v8 only contrib module with v9 patch
You've got the right idea but you don't need to fork Drupal's repository. You can set up composer to read Drupal's git repo instead of using packagist for the naughty modules like this:
    {
        &quot;type&quot;: &quot;package&quot;,
        &quot;package&quot;: {
            &quot;name&quot;: &quot;drupal/cache_control_override&quot;,
            &quot;type&quot;: &quot;drupal-module&quot;,
            &quot;version&quot;: &quot;1.0.0&quot;,
            &quot;source&quot;: {
                &quot;type&quot;: &quot;git&quot;,
                &quot;url&quot;: &quot;https://git.drupalcode.org/project/cache_control_override.git&quot;,
                &quot;reference&quot;: &quot;8db91684a427366d8f9c51f60cbac10c2d586d95&quot;
            }
        },
        {
          &quot;type&quot;: &quot;composer&quot;,
          &quot;url&quot;: &quot;https://packages.drupal.org/8&quot;
        }
    },

Note the 'reference' is a commit hash, though it looks like you can also use tags. Also note that the custom git type: package repo must be before Drupal's default type: composer repo in your composer file.
And then patch as normal using composer:
&quot;drupal/cache_control_override&quot;: {
    &quot;Drupal 9 Compatibility (3132036)&quot;: &quot;https://www.drupal.org/files/issues/2020-04-29/Drupal-9-readiness-3132036-2.patch&quot;
},

Thanks @miststudent2011 for pointing out that this doesn't automatically install dependencies which I can confirm. You will need to require those yourself!
(Shamelessly stolen from @acbramley on Drupal Slack because wider dissemination of this knowledge is worthwhile)