GitLab Runner v18.6.1 does not set up CI job token credentials properly for submodules

This came out of gitlab-org/release/tasks#22307 (comment 2909200858).

This looks like another regression from !5912 (merged). It seems that unless GIT_SUBMODULE_FORCE_HTTPS is set, GitLab Runner v18.6.1 will not add insteadOf entries for Git submodules.

Using https://ops.gitlab.net/gitlab-com/gl-infra/deployer as a test, I modified the .gitlab-ci.yml:

---
default:
  image: alpine:latest
  script:
    - cat .git/config
    - cat /builds/root/deployer.tmp/.gitlab-runner.ext.conf || true
    - apk add git
    - cd $CI_PROJECT_DIR/patches && git pull origin master
  variables:
    GIT_SUBMODULE_STRATEGY: recursive

GitLab Runner 18.5.0

The .git/config shows this:

$ cat .git/config
[init]
	defaultBranch = none
[fetch]
	recurseSubmodules = false
[credential]
	interactive = never
[gc]
	autoDetach = false
[http]
	extraHeader = X-Gitaly-Correlation-ID: 01KAV153KJEJQ5AEYG7GSV8G8K
[transfer]
	bundleURI = true
[core]
	repositoryformatversion = 0
	filemode = true
	bare = false
	logallrefupdates = true
[remote "origin"]
	url = https://gitlab-ci-token:[MASKED]@gitlab.example.com/root/deployer.git
	fetch = +refs/heads/*:refs/remotes/origin/*
[lfs]
	repositoryformatversion = 0
[submodule "deploy-tooling"]
	active = true
	url = https://gitlab-ci-token:[MASKED]@gitlab.example.com/root/deploy-tooling.git
[submodule "patches"]
	active = true
	url = https://gitlab-ci-token:[MASKED]@gitlab.example.com/root/patcher.git

GitLab Runner 18.6.1

.git/config

[init]
    defaultBranch = none
[fetch]
    recurseSubmodules = false
[credential]
    interactive = never
[gc]
    autoDetach = false
[include]
    path = /builds/root/deployer.tmp/.gitlab-runner.ext.conf
[core]
    repositoryformatversion = 0
    filemode = true
    bare = false
    logallrefupdates = true
[remote "origin"]
    url = https://gitlab.example.com/root/deployer.git
    fetch = +refs/heads/*:refs/remotes/origin/*
[lfs]
    repositoryformatversion = 0
[submodule "deploy-tooling"]
    active = true
    url = https://gitlab.example.com/root/deploy-tooling.git
[submodule "patches"]
    active = true
    url = https://gitlab.example.com/root/patcher.git

Notice the Git submodules are missing from this list:

.tmp/.gitlab-runner.ext.conf

[http]
    extraHeader = X-Gitaly-Correlation-ID: 01KAV119X75ZYQHVZ3M65X9YGY
[transfer]
    bundleURI = true
[url "https://gitlab-ci-token:[MASKED]@gitlab.example.com"]
    insteadOf = https://gitlab.example.com