Only update git submodules after checking out specified revision

This caused a problem with a repo that referenced a submodule in the `master` branch, but not in the branch specified in the requirements file; the box in question had firewall rules that disabled outgoing SSH connections.