Allow file:// protocol for nested submodules

HAF's hive submodule uses relative paths (../hive.git) that resolve
to file:// URLs during submodule operations. Git blocks these by
default for security. Setting protocol.file.allow=always enables
them for our CI.