WebComponents: checkout submodule via https rather than git@...