Add some more git flags for safety

.github/workflows/update-submodules.yml

@@ -25,5 +25,5 @@ jobs:
         git config user.name "DFHack-Urist via GitHub Actions"
         git config user.email "DFHack-Urist@users.noreply.github.com"
         if bash -x ci/update-submodules.bash; then
-          git push
+          git push --recurse-submodules=check
         fi

ci/update-submodules.bash

@@ -22,7 +22,7 @@ cat ci/update-submodules.manifest | while read path branch; do
     cd "${git_root}/${path}"
     test "${git_root}" != "$(get_git_root)"
     git checkout "${branch}"
-    git pull
+    git pull --ff-only
     cd "${git_root}"
     if ! git diff --quiet --ignore-submodules=dirty -- "${path}"; then
         git add "${path}"