encore: fix cos.dependencies to point to the official repo for the vendor files

Change-Id: I2f3cc897bf01639322ce18e59f1d7da3ace03a0a