[run-task] Add an option to select specific submodules to update

[ahal]

Currently we just update all submodules we detect, but these are likely not all needed by every task. It would be nice if tasks could pass a list of submodules they need (or disable them entirely) so we can speed up cloning times.

This is particularly painful for mozilla-vpn-client which has a bunch of submodules that take a good while to clone and are hardly ever needed.

[ahal]

We'll have to take care with caches here. I.e, if the checkout is cached we'll need to ensure the appropriate submodules have been initialized.