ExternalProject: Respect TLS_VERIFY for git update step

Git config options can be passed to git clone before or after the "clone" keyword. If specified before, the config setting is only applied to that command invocation. It acts to override the value in the global or project defaults (the latter doesn't exist for clone). When the config setting is passed after the "clone" keyword, it is saved into the cloned repository's config and will persist for later git operations. The existing implementation expected the latter behavior, but put the config setting before the "clone" keyword and therefore the setting was not persisting to the git update step. Move it to after the "clone" keyword so that it will persist.

The submodule handling is different. There is no support for doing a "git submodule update" with a "sticky" config setting. Instead, you have to pass the setting with all such calls. The existing implementation was doing this for the clone step, but not the git update step. Add the config setting there as well so that submodules also effectively have the sslVerify setting persist to the update step too.

Fixes: #18948 (closed)