Use read-only repos for submodules