strip ".git" from the cargo dependencies

This matches the pattern from a couple other libraries, and avoids a bug in cargo where url hashes are not canonicalized.