using 'public' urls for rebar dependencies

 * using git@ forces the client to identify itself with a ssh key
 * updated lager expected version