Use read-only submodule url for heroku compatability

Heroku doesn't have permission to read from the `git` protocol. This uses `https` instead.