Fix edge case where git submodule sync is not being called
Back in !4278 (merged) we made submodule syncing more robust, but we missed one edge case described by user @mlegendre in #36932 (comment 1738174639):
* we git submodule sync again only if the first submodule update
fails
(https://gitlab.com/gitlab-org/gitlab-runner/-/blob/v16.8.0/shells/abstract.go?ref_type=tags#L611-612),
* but the update of a submodule will not fail if it already contains
the commit needed, even if the URL contains expired credentials,
* and yet the git lfs command just below may need valid credentials 💥
The user also provided a potential fix, and also tested it (#36932 (comment 1762404664))
Edited by Axel von Bertoldi