setup.sh: pin submodules to their latest release tag, not master's tip

Both proxy and sso-manager-node now publish real vX.Y.Z tags (see
their own release history). Track those instead of following the
branch tip with `git submodule update --remote`, so a rebuild always
lands on a tagged, versioned release rather than whatever commit
happened to be most recently merged upstream.

Bumps the submodule pins to their current latest tags as a result:
proxy -> v1.1.1, sso-manager-node -> v1.1.1.

README.md

@@ -471,7 +471,8 @@ theta-env/
 gitignored `./config/` (`sso-secrets.js` + `proxy-secrets.js`) and snapshots to
 the gitignored `./backups/` before each rebuild.
 
-`./setup.sh` updates both submodules to the latest of their tracked remote
-branch before building, so each run builds current upstream — no manual
-`git submodule update --remote` needed. To lock to the pinned commits (offline
-rebuild, or a deliberate pin), run `SKIP_SUBMODULE_UPDATE=1 ./setup.sh`.
+`./setup.sh` updates both submodules to their latest `vX.Y.Z` release tag
+before building — not the tip of `master` — so each run builds the newest
+tagged release of each app, not whatever's most recently merged upstream. To
+lock to the pinned commits (offline rebuild, or a deliberate pin), run
+`SKIP_SUBMODULE_UPDATE=1 ./setup.sh`.