feat(build): plugin:install --source and git URLs as submodules

- --source clones each registry repository (https only) at the chosen tag,
  adds it as a submodule under plugins/<vendor>/<name>, absorbs its git
  dir and registers it with the tag as the go.mod require
- git URLs (https, ssh, user@host:path) are cloned with the user's git
  setup and never sent to the registry; the newest tag whose plugin.yaml
  framework minimum fits is checked out, else the default branch head
- go.work replace overrides for every local replace in workspace modules'
  go.mod files (app target, versioned workspace module, or version pin)
- GIT_ALLOW_PROTOCOL=https:ssh, '--' before URLs and paths; non-git apps
  are refused before cloning; plugin:add keeps require v0.0.0

cmd/summer/main.go

@@ -549,6 +549,18 @@ names the framework version to move to; it never changes the framework. The
 plugin is installed as a Go module with go get and listed in summer.yaml.
 --source installs it as a git submodule under plugins/<vendor>/<name> instead.
 
+Required plugins are installed with it, in the same mode, each at the newest
+compatible release that meets its minimum; one the application already has
+must be at least that minimum. Submodule installs require the tag in go.mod,
+add the plugin to go.work and add the go.work replaces its own go.mod needs.
+--source and git URLs need the application to be a git repository.
+
+A git URL is cloned with your own git credentials and never sent to the
+registry. The newest release tag whose plugin.yaml framework minimum fits is
+checked out (the default branch head, with a warning, when none fits), and
+the plugin is added as a submodule. Its required plugins are looked up in the
+registry; with --offline they must be installed already.
+
 The plugins to add are printed as id@version (mode) and confirmed with a
 prompt. --yes skips the prompt; a run without a terminal needs --yes. Run
 summer build afterwards. --offline makes no registry call, so it works only