Change `git submodule` copying mechanism from the host
to the docker container to use `git clone` instead of
`git submodule update --init --reference`, which reaches
out to the network and fails on older docker containers
with deprecated openssl versions that do not support
modern TLS versions required by GitHub, e.g. manylinux1.
This fixes artifact builds for protoc and Python on Linux.