Recipes for packages with submodules

Some projects, for example [`osqp`](https://github.com/oxfordcontrol/osqp-python) and [`shogun`](https://github.com/shogun-toolbox/shogun), don't have release tarballs that contain all of the source needed to build: they use github as the release mechanism and use submodules, but github release tarballs just leave submodules as empty folders.

One option to handle this is to use a git source, but that's [frowned upon](https://conda-forge.org/docs/meta.html#build-from-tarballs-not-repos).

You can instead deal with this in conda-build 3 with multiple sources without _too_ much difficulty with multiple sources in cb3; [for example](https://github.com/conda-forge/osqp-feedstock/blob/a5322ed8bfbf754e673b9a39b55e895dfbe8cbdc/recipe/meta.yaml#L10-L21). But:

- The submodule version needs to be updated appropriately with the new release version. The bot of course doesn't know how to do this, so you need to (a) remember to do it, (b) go look up what version is actually needed, and (c) get the checksum yourself. If you forget to do this, depending on how the submodule is used the build may or may not fail.

- If submodules are added in a new release, you need to go figure that out (https://github.com/conda-forge/osqp-feedstock/pull/2). Same for if they're removed or changed.

Some things that might make this nicer:

- If github would just give us a tarball that included submodules. Not much we can do about that. :/
- If the bot figured out how to update submodules. This would probably only be feasible for github sources, and it would probably need some kind of annotation in the recipe.
- If we decided it was okay to use git sources in cases like this. We could maybe use specific commit numbers instead of version tags to be more like using a checksum. How much of a problem is the Windows issue mentioned [here](https://conda-forge.org/docs/meta.html#build-from-tarballs-not-repos)? (Also, I think conda-build now does shallow clones by default, so the first point is now less relevant?)

Thoughts?