using 'public' urls for rebar dependencies

 * using git@ forces the client to identify itself with a ssh key
 * pointing lager to the release with the expected version