JTAG does not need an external clock for the MCU. You can for example program an empty STM32 MCU via JTAG. FlasingFlashing it via UART also does not require external clocks, as it adapts to any baud rate within limits.
Using USB requires an external clock or crystal. It reads in the datasheet too that HSE must be used for PLL in this case.