fix: add optional submodules input to python-ci (#39)

[kazmosahebi]

Refs #39.

What

Adds an optional submodules input to the reusable python-ci.yml. When set (e.g. submodules: schemas), the test job runs git submodule update --init --depth 1 <paths> after checkout (value passed via env to avoid script injection). Default empty -> a no-op for every current consumer.

Why

Consumer tests that read submodule content currently fail in CI because the reusable-workflow checkout fetches no submodules. Concretely: dfe-engine resolves ClickHouse schema profiles from its schemas submodule (schemas/common-header/*.yaml) and falls back to stale bundled profiles when it is absent, so a 1.1.0 profile test fails in CI while passing locally.

Scope / constraints

• python-ci.yml only for now (the dfe-engine case). Easy to extend to the other language workflows if needed -- see Add optional submodules input to reusable CI (public submodules) #39.
• Init lives in the test job, the only one that consumes submodule content (quality lints src/, build packages src/).
• Works for a public submodule with the default GITHUB_TOKEN. A private submodule still can't be cloned by the default token -- those keep using the skipif pattern (or a configured cross-repo token).

Docs

• docs/LESSONS.md reconciled: skipif for private submodules; the submodules input for public ones.

Verification

• tests/unit/test_workflow_consistency.py: 45 passed (YAML valid, gates/threading intact).
• Default-empty input means no behaviour change for any repo that doesn't opt in.

Consumer opt-in (after merge)

A repo with a public submodule adds to its ci.yml:

    with:
      submodules: schemas