Chezmoi "add" cannot add anything in parent of external

Describe the bug

If a directory contains an external that's already been populated via apply, running add on the directory (the parent of the external, I mean) fails with:

chezmoi: /root/normal-dir/repro-submodule/.git: cannot add entry in external_ directory

(...or any file name in place of .git depending upon what's in there.)

To reproduce

create a submodule within Chezmoi's source directory, prefixed with external_
run chezmoi apply
run chezmoi add <target directory housing the submodule>

Expected behavior

No change in source state. Specifically, the existence of files underneath the "external" directory shouldn't be an error when operating on a parent directory recursively.

Output of command with the `--verbose` flag

$ chezmoi -S "$CI_PROJECT_DIR" add --verbose "$HOME/normal-dir"
chezmoi: /root/normal-dir/repro-submodule/.git: cannot add entry in external_ directory

Output of `chezmoi doctor`

```console RESULT CHECK MESSAGE warning version v2.47.1, built at 2024-03-11T12:05:48Z, built by Alpine Linux ok latest-version v2.47.1 ok os-arch linux/amd64 (Alpine Linux) ok uname Linux runner-ns46nmmj-project-54387395-concurrent-0 5.4.109+ #1 SMP Wed Jun 16 20:00:10 PDT 2021 x86_64 Linux ok go-version go1.22.1 (gc) ok executable /usr/bin/chezmoi ok upgrade-method upgrade-package ok config-file no config file found ok source-dir /builds/detly/chezmoi-externals-repro is a git working tree (clean) ok suspicious-entries no suspicious entries ok working-tree /builds/detly/chezmoi-externals-repro is a git working tree (clean) ok dest-dir ~ is a directory ok umask 022 ok cd-command found /bin/sh ok cd-args /bin/sh info diff-command not set ok edit-command found /usr/bin/vi ok edit-args /usr/bin/vi ok git-command found /usr/bin/git, version 2.44.0 warning merge-command vimdiff not found in $PATH ok shell-command found /bin/sh ok shell-args /bin/sh info age-command age not found in $PATH info gpg-command gpg not found in $PATH info pinentry-command not set info 1password-command op not found in $PATH info bitwarden-command bw not found in $PATH info bitwarden-secrets-command bws not found in $PATH info dashlane-command dcli not found in $PATH info doppler-command doppler not found in $PATH info gopass-command gopass not found in $PATH info keepassxc-command keepassxc-cli not found in $PATH info keepassxc-db not set info keeper-command keeper not found in $PATH info lastpass-command lpass not found in $PATH info pass-command pass not found in $PATH info passhole-command ph not found in $PATH info rbw-command rbw not found in $PATH info vault-command vault not found in $PATH info vlt-command vlt not found in $PATH info secret-command not set ```

Additional context

There's a git repo that reproduces the issue here, with a CI job showing the output. If this seems familiar it's because it's basically my report for #3525 but run against 2.47.1 in Alpine Edge.

I'll also mention that adding an ignore entry for the subdirectory (ie. the "external" directory but without the external_ prefix) does not help here. In fact, doing this perfectly reproduces the effects of the pre-#3525 behaviour.

(How good are externals, hey? You must love them.)

twpayne / chezmoi