This option is only valid for the update command. Instead of using the superproject’s recorded SHA-1 to update the submodule, use the status of the submodule’s remote-tracking branch.
This is equivalent to running git pull in each submodule.
However, how would I push a commit in the scenario of bug fix in C which affects the code shared with the parent layers?
Again: using submodule will place your code inside your main project as part of its content. The difference between having it locally inside the folder or having it as part of a submodule is that in submodule the content is managed (commited) to a different standalone repository.
This is an illustration of submodule - project inside another project in which each project is a standalone project.
git subtree
Git subtree allows you to insert any repository as a sub-directory of another one
Very similar to submodule but the main difference is where your code is managed. In submodules the content is placed inside a separate repo and is managed there which allow you to clone it to many other repos as well.
subtree is managing the content as part of the root project and not in a separate project.
Instead of writing down how to set it up and to understand how to use it you can simply read this excellent post which will explain it all.
Answering your X problem not your Y problem (xyproblem.info), you should not use submodules for this task. You should create a .gitignore to exclude the secrets from VCS. Alternatively, you could make the code read the config files from outside the VCS directory, so you can keep them in ~/.config. Storing config files in a private repo is almost never the right way.
P.S. the answer by CodeWizard answers the Y problem perfectly.