Git sanity checks

[dmach]

We want to introduce several safe-guards to the git workflow to prevent unexpected data pushed to the git repos.

These need to be run in multiple places, because erroring out during a pull request merge is too late.

• on creating a commit (git hook)
• on pushing commits (git hook)
• in a pull request (gitea action)
• on merging pull request (git hook)

We also can't allow checking the overall state, but we MUST check every individual commit,
because project submodules may point to any revision of packages. Maybe we're too paranoid, but it would be good to stay at the safe side.

Tasks:

• return state of git submodules for an arbitrary commit in history
• have a central configuration for enforcing the checks, possibly a special org/repo that can be written by admins only