subrepos: ignore and warn about any modifications to .gitmodules

Populating or modifying these from the Mercurial side of things seems
inherently unsafe. Not sure how this could happen in the wild, except
maybe with old clones.
24 jobs for topic/default/submodule-push in 31 minutes and 7 seconds (queued for 4 seconds)