Draft: gitlab-ci: Add linter validating that all submodules are released

As pointed out in #16200, this has historically been an area quite prone to errors. Let's try checking it manually.=

The approach implemented here is a bit suboptimal:

• it will spuriously fail in the case of Hackage revisions, which are generally untagged. I think we will simply need to insist that upstreams tag such revisions in the future.
• the linter only runs on builds of tags. Ideally we would just warn on non-tag builds of a stable branch.