Remove sources.csv and fetch.py

* Move source tarball URLs into spec files
* Tidy up %setup macros
* Generate Makefile rules to download tarballs, and refresh them whenever the spec files change