package.json: use "https://" repo URL to be more firewall-friendly; update licenses URL