bin/compile: Switch to spectool -l

Rather than letting spectool download the sources, just ask it for the
URLs and download them ourself. This gives us much cleaner output
(using curl instead of wget) and more control over caching in
CACHE_DIR.

Also, if a "sources" file is present in the root, assume it's an MD5
checksum file and verify it. This is a convention in the Fedora repos
at http://pkgs.fedoraproject.org/