Support flows around submodule changes in the VMR

[premun]

Context

We agreed on the following flow for internal changes requiring submodule changes:

• Submodule is forked
• Change is made to the submodule
• The VMR is updated to the commit from step above

On release day:

• VMR changes are merged publicly
• Submodule fork changes are pushed publicly - the SHA becomes available publicly
• VMR backflows into the public repo, carrying the submodule changes
  • Submodule is repointed by the codeflow automatically
  • The PR build fails because the submodule points to the internal fork still
  • The URL is reverted to the public one, the commit is available publicly anyway
  • Backflow is merged and we're done
  • The change to public URL is later forward-flown

Goals

In order to achieve the above, we must be able to effectively:

• Rewind submodules in the VMR directly
• Backflow such a change
• Guard against mismatches in submodules during forward flows