feat: add submodule checkout

[gondoi]

No description provided.

[cursor]

PR Summary

Medium Risk
Adds a new GitHub App–based checkout path and new workflow_call inputs/secrets; misconfiguration could break builds or broaden repository access via the minted app token.

Overview
Adds a new checkout-repo composite that can mint a GitHub App token and perform recursive private submodule checkout.

Updates the docker-build-push.yml reusable workflow to optionally use this composite instead of plain actions/checkout, exposing new inputs (checkout-submodules, checkout-app-repositories) and an optional APP_KEY secret for callers.

Expands .github/README.md to document the new composite and provide an example for building Docker images with private submodules.

^{Reviewed by Cursor Bugbot for commit 28db1d0. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 482a41f. Configure here.}