Lock git modules in package.json to their current hashes