Allow post-checkout scripts to run during CI dependency builds

[DavidHuber-NOAA]

Description

This tells git to allow post-checkout scripts to run during dependency building, which was disabled by default for security reasons in recent versions.

Resolves #748

Type of change

Please delete options that are not relevant.

• Bug fix (non-breaking change which fixes an issue)

How Has This Been Tested?

CI ran successfully after commit.

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• New and existing tests pass with my changes

[AlexanderRichert-NOAA]

To state the (possibly) obvious, this will make it all the more important to be careful to not clone sketchy repos that might do malicious or otherwise unwanted things with their Git hooks... But for the software used and foreseeably used in these workflows, I don't see this being a problem.

[AlexanderRichert-NOAA]

In the case of the crtm one that was causing issues, it's a hook that checks to see whether git-lfs is available.

[RussTreadon-NOAA]

The unsafe behavior @AlexanderRichert-NOAA mentions concerns me. I am not familiar with git workflows. Is turning off protections via GIT_CLONE_PROTECTION_ACTIVE=false limited to https://github.com/JCSDA/spack.git?

Why didn't we need to set GIT_CLONE_PROTECTION_ACTIVE=false in the past? What changed?

[DavidHuber-NOAA]

@RussTreadon-NOAA It appears that this issue will be fixed soon by Git. As mentioned here, git-lfs (which CRTM uses) requires a post-checkout hook. Git will whitelist git-lfs soon so that the GIT_CLONE_PROTECTION_ACTIVE flag does not need to be set to False. We could wait until the new version of git is released and try to run a CI build at that point instead of merging this PR.

[RussTreadon-NOAA]

Thank you @DavidHuber-NOAA for sharing this. If the change will be implemented soon, my preference is to wait. We only have two active GSI PRs, excluding this one, at present. If we merge this PR into develop, we'll need to unmerge it via a subsequent PR later. What do @AlexanderRichert-NOAA and you think?

[DavidHuber-NOAA]

I'm good with waiting.

[DavidHuber-NOAA]

I believe this issue has been resolved by git now. I'm reverting the changes to allow CI to rerun.

[DavidHuber-NOAA]

CI passed, closing this PR.