Validate submodule names on every module path branch

<!-- agent -->
_module_abspath only validated names when Git used separate gitfile
submodule directories, so legacy Git behavior could accept the same invalid
name. Validate before selecting the Git-version-dependent path branch and
cover the legacy branch explicitly.

Git baseline: submodule.c at 883a47ef6496c96a5d6132ed8c87fcd44ebf8d1a
validates submodule paths before filesystem operations.

Assisted-by: GPT 5.6
Co-authored-by: GPT 5.6 <codex@openai.com>

Author: Byron

git/objects/submodule/base.py

@@ -316,8 +316,9 @@ def _validated_name(cls, name: str) -> str:
 
     @classmethod
     def _module_abspath(cls, parent_repo: "Repo", path: PathLike, name: str) -> PathLike:
+        name = cls._validated_name(name)
         if cls._need_gitfile_submodules(parent_repo.git):
-            return osp.join(parent_repo.git_dir, "modules", cls._validated_name(name))
+            return osp.join(parent_repo.git_dir, "modules", name)
         if parent_repo.working_tree_dir:
             return osp.join(parent_repo.working_tree_dir, path)
         raise NotADirectoryError()

test/test_submodule.py

@@ -971,6 +971,10 @@ def test_update_rejects_parent_component_in_name(self, rwdir):
             with pytest.raises(ValueError, match="submodule name"):
                 Submodule._module_abspath(clone, "module", name)
 
+        with mock.patch.object(Submodule, "_need_gitfile_submodules", return_value=False):
+            with pytest.raises(ValueError, match="submodule name"):
+                Submodule._module_abspath(clone, "module", "../module")
+
     @with_rw_directory
     @_patch_git_config("protocol.file.allow", "always")
     def test_root_update_keeps_going_after_invalid_submodule_name(self, rwdir):