Document how submodules can be updated as part of the build script

Some users update submodules as part of their build commands, not using GIT_SUBMODULE_STRATEGY=(normal|recursive) and therefor not letting the runner pull/update the submodules.

This can be problematic when private submodules are at play.

We should update the documentation around that

• encourage using the runner to manage submodules
• for cases where users have to manually manage submodules, provide documentation on how users can update submodules themselves, with proper auth
  • with both values of FF_GIT_URLS_WITHOUT_TOKENS
    • false ... (maybe) provide an example using a insteadOf= arg which uses ${CI_JOB_TOKEN}
    • true ... (maybe) provide an example using a include.path="${RUNNER_TEMP_PROJECT_DIR}/cred-helper.conf" arg leveraging the systems cred helper
  • across different supported shells

Note:

For some users it seems to have worked without explicitly providing creds; the assumption is that they had hardcoded creds cached in .gitmodules/.git/modules/${module}/config

Current related docs:

• https://docs.gitlab.com/ci/runners/git_submodules/
• https://docs.gitlab.com/ci/runners/configure_runners/#git-submodule-strategy
• https://docs.gitlab.com/runner/executors/#prerequisites-for-non-docker-executors