Rework how the script works: all submodule commits & tagging now happen

before anything is pushed, instead of pushing each project as we finish
updating it.  If any operation on any of the repositories fails, we should
now know before pushing to any of the repositories.  That will reduce
the number of times you need to go in and manually remove tags, MRs,
branches.

Also improve initial validation

Added a --cleanup flag to remove branches, MRs, and tags from failed
runs