Switch dependencies from git to tarball

[jishi]

@GermanBluefox I created a new issue for this so we don't spam the others with irrelevant emails.

I have considered this for a long time but haven't gotten around to it, mainly because it requires more juggling with versions and tagging. But it is better to not depend on git, I agree.

[jishi]

http-api is using tarball dependency for now.