Add submodule pin check to CI

.github/workflows/submodule-pin-check.yml

@@ -0,0 +1,20 @@
+name: Merge Checks
+
+on:
+  pull_request:
+    branches: [ master ]
+    types: [synchronize, opened, reopened, labeled, unlabeled]
+
+jobs:
+  submodule-pin-check:
+    name: Submodule Pin Check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Check all submodules are under origin/HEAD
+        run: git submodule foreach git merge-base --is-ancestor HEAD origin/HEAD
+