explicitly use https for submodule cloning