use https URLs for submodules

since that's what GitHub recommends these days