Only use submodules from leap.se

pulling from other sources is a security hole.

(from redmine: created on 2013-07-09, closed on 2013-09-14, relates #3137 (closed), blocks #3676, blocks #3779 (closed))