build: Improve source file downloading

* Make SRPM targets depend on sources and patches as well as spec files, so that if any of these change the SRPM (and RPMs it produces) are rebuilt
* Change xen-org to xapi-project in sources.csv, to reflect project name change
* Fix GitHub download URLs to pin versions and set the downloaded file name correctly

The file name at the end of a github.com/<user>/<repo>/archive URL is arbitrary, so we shouldn't need the 'override' feature of fetch.py for GitHub downloads - we can just ask for the filename we want.   Fetching from github.com/<user>/<repo>/archive seems to return the most recent version, not necessarily the version we want (the version in the filename is ignored, because GitHub doesn't care about the filename - it seems that if you get a tarball corresponding to a particular tag, that's just because there are no newer changes). Therefore we should request archive/<tag>/filename-1.2.3.tar.gz, to make sure we always get the same version.    This may explain why the shorthash spontaneously changed in https://github.com/xapi-project/xen-api-rpm-buildroot/pull/72.

The tag is included in the name of the top level directory in the tarball: <repo>/archive/<tag> results in a toplevel directory of <repo>-<tag>.   RPM assumes that a tarball for an RPM called <name>-<version> will unpack to such a directory and will find it automatically.   Therefore wherever possible we should use purely numeric tags to mark releases.   If we name the tags <repo>-<tag>, the resulting tarballs have top level directories of the form <repo>-<repo>-<tag>, and we need to use %setup -n <name> in the spec file.