setup.sh: update submodules to latest before building

Add a first step to setup.sh that runs `git submodule update --init --remote
--recursive`, so each ./setup.sh builds from the newest sso-manager-node + proxy
upstream rather than whatever was pinned at clone time. --init also populates
the submodules if the repo was cloned without --recursive.

Behavior:
- If the fetch is unreachable (offline), warn and continue building the
  currently checked-out code instead of hard-failing.
- SKIP_SUBMODULE_UPDATE=1 locks to the pinned commits (offline rebuild /
  deliberate pin).
- Verifies the build contexts (Dockerfile.openldap, Dockerfile) exist and
  dies with a clear message if a submodule was never initialized.
- Requires git (added to the Requires line); git absent is fatal unless
  SKIP_SUBMODULE_UPDATE=1.

Renumbered the subsequent step headers (env -> 2, sso-manager -> 3, ...).
README repo-layout note updated to say setup.sh auto-updates submodules.

Co-Authored-By: Claude <noreply@anthropic.com>

README.md

@@ -263,5 +263,7 @@ theta-env/
 └── proxy/                # git submodule
 ```
 
-The two submodules pin a known-good version of each project. Update them with
-`git submodule update --remote` (then re-run `setup.sh` to rebuild).
+`./setup.sh` updates both submodules to the latest of their tracked remote
+branch before building, so each run builds current upstream — no manual
+`git submodule update --remote` needed. To lock to the pinned commits (offline
+rebuild, or a deliberate pin), run `SKIP_SUBMODULE_UPDATE=1 ./setup.sh`.