Convert all dependencies to using git commit hashes

[seanmiddleditch]

Per CMake recommendation, as much as it hurts because of the loss of GIT_SHALLOW