<!--- Verify first that your feature was not already discussed on GitHub -->
<!--- Complete *all* sections as described, this form is processed automatically -->

##### SUMMARY

The Git module encourages use of `StrictHostKeyChecking=no` with SSH, which makes the connection vulnerable to a MITM attack.

##### ISSUE TYPE

OpenSSH 7.5+ (2017-03-20) added a safer option which automatically accepts the key on first use but will not allow a MITM on subsequent connections: `StrictHostKeyChecking=accept-new` 

https://man.openbsd.org/ssh_config#StrictHostKeyChecking

It would be great if Ansible encouraged use of that mode by default in the documentation and to implement features such as the Git module's [`accept_hostkey`](https://github.com/ansible/ansible/blob/323d2adfcce9a53e906c2c4a40f6ac5fb32a0e68/lib/ansible/modules/git.py#L1103-L1108) feature.

##### ANSIBLE VERSION

```paste below
N/A
```

##### COMPONENT NAME
* `/modules/source_control/git.py`


if path is None:
        return None
    
    return os.path.normpath(os.path.realpath(os.path.expanduser(os.path.expandvars(path))))
def get_submodule_update_params(module, git_path, cwd):
    
    
    
    params = []
    
    cmd = "%s submodule update --help" % (git_path)
    rc, stdout, stderr = module.run_command(cmd, cwd=cwd)
    lines = stderr.split('\n')
    update_line = None
    for line in lines:
        if 'git submodule [--quiet] update ' in line:
            update_line = line
    if update_line:
        update_line = update_line.replace('[', '')
        update_line = update_line.replace(']', '')
        update_line = update_line.replace('|', ' ')
        parts = shlex.split(update_line)
        for part in parts:
            if part.startswith('--'):
                part = part.replace('--', '')
                params.append(part)
    return params
def write_ssh_wrapper(module_tmpdir):