gojsonsm, jsonx, gocbconnstr should be locked to SHA in Server manifests

All projects in Server manifests should either be in Gerrit (preferred) or else locked to SHA in the manifest, requiring a specific change in the manifest to bring new commits into Server builds. Without this, we are unprotected against untested and/or unapproved commits entering Server builds. This can lead to build breakages or, worse, unexpected and untested changes late in the release cycle.

Current gojsonsm, jsonx, and gocbconnstr are pointing to their "master" branches in neo.xml, and are not in Gerrit. None of these projects are "owned" by Server (they come from SDK), I believe, but there needs to be a Server engineer who serves as gatekeeper.