chore(cmake): adopt submodule-first deps and standardize FetchContent usage

[mmorel-35]

Description

• Adopt a "submodule-first, FetchContent-fallback" strategy for third-party dependencies:

  • Default *_FETCHCONTENT to OFF in top-level CMakeLists.txt and prefer pinned submodules under 3rdparty/.
  • Each cmake/*.cmake module auto-detects a local submodule and enables FetchContent only as a fallback when the submodule is absent.
  • Auto-detection is non-authoritative (does not FORCE cache values) so -D overrides from users take precedence; a sanity check fails when the user explicitly requests both modes.

• Add and pin third-party submodules (commits/tags):

  • 3rdparty/spdlog (pinned)
  • 3rdparty/fmt (pinned to 8.1.1)
  • 3rdparty/httplib (pinned to v0.22.0)
  • 3rdparty/skywalking-data-collect-protocol (pinned to v10.3.0)
  • 3rdparty/grpc (pinned to v1.74.1)

• Standardize FetchContent declarations:

  • Use GIT_REPOSITORY + GIT_TAG (via *_GIT_URL / *_GIT_TAG variables) for FetchContent where appropriate so pins can be tags or commit SHAs.
  • For gRPC, support archive or git+tag; when using git clone, initialize nested submodules after FetchContent_Populate.

• Move and tidy dependency logic:

  • Move auto-detection and conflict validation into each dependency module (cmake/*.cmake) to keep CMakeLists.txt lean.
  • Disable *_FETCHCONTENT automatically only when the submodule is present and the user has not explicitly requested FetchContent.

• CI and docs:

  • Update CI (.github/workflows/main.yml) to checkout submodules recursively and build gRPC from 3rdparty/grpc.
  • Update README.md documenting submodule-first workflow, FetchContent fallback, GIT_REPOSITORY+GIT_TAG usage, and the bump procedure.

• Additions and refactors:

  • Add cmake/skywalking.cmake and expose SKYWALKING_PROTOCOL_PATH for proto2cpp.
  • Harmonize FetchContent usage and expose *_GIT_URL / *_GIT_TAG variables for maintainability.

Why

• Improves reproducibility and developer ergonomics by making dependency pins explicit and consistent.
• Allows local -D overrides for advanced use-cases or debugging while keeping CI deterministic.