The previous commit reworked things such that the submodule linter would
only run on the head commit. However, the linter only checks the
submodules which are touched by the commits it is asked to lint.
Consequently it would be possible for a bad submodule to sneak through.

Thankfully, we can use the handy CI_COMMIT_BEFORE_SHA attribute to
find the base commit of the push.