strip ".git" from the cargo dependencies

This matches the pattern from a couple other libraries, and avoids
a bug.