submodule: reject submodule.update = !command in .gitmodules