Fetch the two forks over HTTPS, and stop cloning 29 submodules to lint CSS

Two consequences of becoming the meta-repo, neither of which the merge itself
could have caught.

The submodule URLs were written as [email protected]: because that is how they are
pushed from here. That is a working copy's business, not the repository's:
upstream names all 29 over HTTPS, a clone with no key configured is the normal
case, and CI has no key at all. The URLs are now HTTPS; each submodule's own
origin stays SSH, which is where it belongs.

The assets job asked for `submodules: recursive` back when this repository had
two of them. It now names 29, and 27 are the rest of COSMIC -- several gigabytes
fetched per run to check that some CSS is in step with its generator. It fetches
the one it needs instead.

That one is cosmic-session, because install-assets.sh also places the session
entry point that lives in that fork. The script skips those two files with a
warning when the checkout is absent rather than failing, so a fetch that
silently stopped working would quietly reduce what the job covers instead of
turning it red. Hence the `test -f` after it.

.gitmodules

@@ -1,10 +1,10 @@
 [submodule "cosmic-session"]
     path = cosmic-session
-	url = git@github.com:outbackdingo/hyprcosmic-session.git
+	url = https://github.com/outbackdingo/hyprcosmic-session
     branch = master
 [submodule "cosmic-comp"]
     path = cosmic-comp
-	url = git@github.com:outbackdingo/hyprcosmic-comp.git
+	url = https://github.com/outbackdingo/hyprcosmic-comp
     branch = master
 [submodule "cosmic-panel"]
     path = cosmic-panel