Launchpad submodules use 3rd-party sources and wrong commits

There are two issues with the [inkscape-trunk-daily](https://code.launchpad.net/~inkscape.dev/+recipe/inkscape-trunk-daily) PPA on Launchpad, whose recipe currently reads: ``` # git-build-recipe format 0.4 deb-version 1:1.5.0+{time}+{git-commit} lp:inkscape master nest-part packaging lp:inkscape packaging/debian debian master nest extensions lp:inkscape-extensions share/extensions master nest extensionclipart lp:inkscape-extension-clipart share/extensions/other/clipart master nest afdesign lp:inkscape-afdesign share/extensions/other/extension-afdesign main nest extensionxaml lp:inkscape-extension-xaml share/extensions/other/extension-xaml main nest extensiongcode lp:inkscape-extension-gcodetools share/extensions/other/gcodetools main nest extensionman lp:inkscape-extension-manager share/extensions/other/inkman master nest themes lp:~inkscape.dev/inkscape-themes/+git/master share/themes master nest 2geom lp:lib2geom src/3rdparty/2geom master nest libcroco lp:~reviczky/inkscape/+git/libcroco src/3rdparty/libcroco master nest libdepixelize lp:~reviczky/inkscape/+git/libdepixelize src/3rdparty/libdepixelize master nest libuemf lp:libuemf src/3rdparty/libuemf master nest translations lp:~reviczky/inkscape/+git/translations po master nest capypdf lp:~inkscape.dev/capypdf/+git/trunk src/3rdparty/capypdf master ``` 1. Some of the submodules are owned by `reviczky`. 2. Submodules are checked out to their respective `master` branches. What should actually happen is: 1. Submodules should either be official upstreams or be owned by `inkscape.dev`. 2. Submodules should be checked out as if you typed `git submodule update`. This is problematic because: * (2) means Launchpad is building different code to CI and developers. It is not Inskcape master, and may have subtly different bugs, leading to confusion for testers. Submodule updates could break the build at any time. * The combination of (1) and (2) means imported projects not under `inkscape.dev` control could be silently changed to point to arbitrary code. While I trust the owner, it is needless attack surface for supply-chain attacks. Which are, notoriously, a thing at the moment. They are hard to fix because of Launchpad limitations/bugs: * It is impossible to register an `inkscape.dev`-controlled repository on LP that imports https://gitlab.com/inkscape/devel/libdepixelize, because a repository controlled by someone else already imports it. * Launchpad upstream resists fixes to make it check out correct submodule commits - https://bugs.launchpad.net/git-build-recipe/+bug/1733603. I'm not convinced by cjwatson's reply in that thread. * Note that if (2) were fixed by launchpad, we wouldn't have to worry about (1) - it would be fine.

issue