use https URLs for submodules

since that's what GitHub recommends these days
Merge remote-tracking branch 'origin/5.0.x'