build: Work around RPM library limitations in RPM 4.8 on CentOS 6.4

CentOS 6.4 ships with RPM 4.8.   In this version, the sourceHeader
object doesn't seem to handle the 'sources' and 'patches' RPM tags.
Asking for spec.sourceHeader['sources'] always returns an empty list.
Work around this by using spec.sources, which contains the full paths
of sources and patches.

Signed-off-by: Euan Harris <euan.harris@citrix.com>