`Git::run_safe` once in `hotfix merge.`

Add param to `Git::submodules_update` that makes the function either
return or exec a command.
Make `hotfix merge` use only one entire `Git::run_safe`

Add param to `submodules_update` that allows one to return a string of
the command rather than execute it.