Fix three defects found while cross-checking the documentation

**`PrepareJob.yml`: submodules were never detected.** The check tested for a
file named `.gitsubmodules`; Git's file is `.gitmodules`. `has_submodules` was
therefore always `'false'` and `git_submodule_count`, `git_submodule_names` and
`git_submodule_paths` kept their initial empty values for every repository. The
block already had the correct name in a local variable one line below, which is
now used for the test as well.

Verified against a scratch repository with two submodules:

```
has_submodules=true
count=2
names=libA:libB
paths=deps/libA:deps/libB
```

and `has_submodules=false` once the file is removed.

**`CleanupArtifacts.yml`: an unknown artifact ID raised `NameError`.** Both
compute steps call `printf(...)` in their `case _:` fallback, but the step runs
`shell: python`, where `printf` is not a function. An `artifact-json-ids` entry
that is not a key of the JSON dictionary - a typo, or a key removed from
`Parameters.yml` while a consumer still lists it - aborted the step with
`NameError: name 'printf' is not defined` instead of reporting the name. That is
precisely the case the branch exists for.

Reproduced against the previous revision (exit code 1, `NameError`) and against
this one:

```
Name 'typo_key' not found in JSON dictionary.
Artifact to delete:
  pyX-UnitTestReportSummary-XML-*
  pyX-Packages
```

`_Checking_CleanupArtifacts.yml` now passes an `unknown_key` entry, so the
branch is exercised by the verification pipeline.

**`CheckCodeQuality.yml`: the security scan could be skipped silently.** The
`Bandit` step was guarded by `if: inputs.artifact != ''`, although the step
writes its report to a fixed path and never used that parameter. An empty
artifact name skipped the scan while the job still reported success. The guard
is removed; the scan now runs whenever the job runs.

Co-Authored-By: Patrick Lehmann <Paebbels@gmail.com>

Author: claude-code

.github/workflows/CheckCodeQuality.yml

@@ -86,7 +86,6 @@ jobs:
 
       - name: 👮 Bandit
         id: bandit
-        if: inputs.artifact != ''
         run: |
           set +e
 

.github/workflows/CleanupArtifacts.yml

@@ -96,7 +96,7 @@ jobs:
               case [prefix, key, postfix] if key in artifactNames:
                 artifacts.append(f"{prefix}{artifactNames[key]}{postfix}")
               case _:
-                printf(f"Name '{name}' not found in JSON dictionary.")
+                print(f"Name '{name}' not found in JSON dictionary.")
 
           print("Artifact to delete:")
           for name in artifacts:
@@ -143,7 +143,7 @@ jobs:
               case [prefix, key, postfix] if key in artifactNames:
                 artifacts.append(f"{prefix}{artifactNames[key]}{postfix}")
               case _:
-                printf(f"Name '{name}' not found in JSON dictionary.")
+                print(f"Name '{name}' not found in JSON dictionary.")
 
           print("Artifact to delete:")
           for name in artifacts:

.github/workflows/PrepareJob.yml

@@ -366,9 +366,9 @@ jobs:
           fi
 
           # Submodules
-          if [[ -f .gitsubmodules ]]; then
+          git_modules_file=.gitmodules   # $(git rev-parse --show-toplevel)/.gitmodules
+          if [[ -f "${git_modules_file}" ]]; then
             has_submodules="true"
-            git_modules_file=.gitmodules   # $(git rev-parse --show-toplevel)/.gitmodules
             git_submodule_count="$(grep -Po '(?<=\[submodule \")(.*)(?=\"\])' "${git_modules_file}" | wc -l)"
             git_submodule_names="$(grep -Po '(?<=\[submodule \")(.*)(?=\"\])' "${git_modules_file}" | paste -sd ':' -)"
             git_submodule_paths="$(git config --file "${git_modules_file}" --null --name-only --get-regexp '\.path$' | xargs -0 -n1 git config --file "${git_modules_file}" --get | paste -sd ':' -)"

.github/workflows/_Checking_CleanupArtifacts.yml

@@ -57,8 +57,10 @@ jobs:
       - Package
     with:
       json: ${{ needs.Params.outputs.artifact_names }}
+      # Deliberate added 'unknown_key' for exception testing.
       artifact-json-ids: >-
         unittesting_xml:-*
+        unknown_key
       # The package artifact is kept on tagged runs, so 'PublishOnPyPI.yml' can still consume it.
       json2: ${{ needs.Params.outputs.artifact_names }}
       condition2: ${{ ! startsWith(github.ref, 'refs/tags') }}