CMake configure runs `checkout_externals` unconditionally

[fmahebert]

Problem:

The CMake in src/core_atmosphere/CMakeLists.txt runs checkout_externals unconditionally on every configure. Logging the run shows the default (update) path makes three network round-trips per external:

git fetch --quiet --tags origin                  ← network
git ls-remote --exit-code --heads origin <tag>   ← network
git ls-remote --exit-code --heads origin <tag>   ← network (identical, repeated)
git checkout --quiet <tag>                       ← onto the commit it is already on, for most re-configures

With two externals (MMM-physics @ 20250616-MPASv8.3, UGWP @ MPAS_20241223) that is six GitHub round-trips, measuring in at 3–4 s on my dev system, for cold and warm configures alike, pulling data for tags that are likely already up-to-date locally.

Besides the time cost, the other consequence is that configure fails with no network. This blocks air-gapped builds, sandboxed CI, or any build behind a flaky network.

Proposed fix:

Use checkout_externals --status to check whether the externals match their Externals.cfg versions. This operates locally, with no network, in essentially ~0 s. Therefore, we can run it first and only fall through to the update when a component is missing, on the wrong version, or locally modified.

[guoqing-noaa]

I would advocate we adopt the standard git submodule method for this situation.