submodules: use https instead of ssh