fix: ignore includes in submodule configuration

Submodule configuration is read from .gitmodules, whose contents may come
from an untrusted repository. Its parser inherited merge_includes=True and
could therefore open files named by include directives during ordinary
submodule enumeration.

Disable include merging at the SubmoduleConfigParser construction site. This
matches Repo.config_writer() hardening from 41ecc6a and addresses
GHSA-7833-fr7j-v32q without changing include behavior for trusted config
parsers.

The regression points .gitmodules at a non-config file and verifies the
submodule entry remains readable without opening the included path.

Validation:
- pytest -q test/test_submodule.py::TestSubmodule::test_gitmodules_does_not_merge_includes
- pytest -q
- ruff check git/objects/submodule/base.py test/test_submodule.py
- ruff format --check git/objects/submodule/base.py test/test_submodule.py

Author: codex

git/objects/submodule/base.py

@@ -270,7 +270,7 @@ def _config_parser(
             raise ValueError("Cannot write blobs of 'historical' submodule configurations")
         # END handle writes of historical submodules
 
-        return SubmoduleConfigParser(fp_module, read_only=read_only)
+        return SubmoduleConfigParser(fp_module, read_only=read_only, merge_includes=False)
 
     def _clear_cache(self) -> None:
         """Clear the possibly changed values."""

test/test_submodule.py

@@ -1207,6 +1207,22 @@ def test_ignore_non_submodule_file(self, rwdir):
 
         assert len(parent.submodules) == 0
 
+    @with_rw_directory
+    def test_gitmodules_does_not_merge_includes(self, rwdir):
+        parent = git.Repo.init(rwdir)
+        secret_path = osp.join(rwdir, "secret")
+        with open(secret_path, "w", encoding="utf-8") as secret:
+            secret.write("not git config\n")
+        with open(osp.join(rwdir, ".gitmodules"), "w", encoding="utf-8") as modules:
+            modules.write('[submodule "module"]\n')
+            modules.write("\tpath = module\n")
+            modules.write("\turl = https://example.com/module.git\n")
+            modules.write("[include]\n")
+            modules.write("\tpath = %s\n" % secret_path)
+
+        parser = Submodule._config_parser(parent, None, read_only=True)
+        self.assertEqual(parser.get_value('submodule "module"', "path"), "module")
+
     @with_rw_directory
     def test_remove_norefs(self, rwdir):
         parent = git.Repo.init(osp.join(rwdir, "parent"))