Running clang with -mllvm --print-changed=quiet -mllvm --print-module-scope and grepping for llvm.loop.unroll.disable should show which pass adds llvm.loop.unroll.disable.
Searching “llvm.loop.unroll.disable” in LLVM shows Loop::setLoopAlreadyUnrolled() which is probably where that gets added. The various unroll passes will set the metadata once they’ve done some sort of unrolling/peeling so that another pass in the future won’t do it again.