build: Improve source file downloading

* Make SRPM targets depend on sources and patches as well as spec files, so that if any of these change the SRPM (and RPMs it produces) are rebuilt
* Change xen-org to xapi-project in `sources.csv`, to reflect project name change
* Fix GitHub download URLs to pin versions and set the downloaded file name correctly

The file name at the end of a `github.com/<user>/<repo>/archive` URL is arbitrary, so we shouldn't need the 'override' feature of `fetch.py` for GitHub downloads - we can just ask for the filename we want.   Fetching from `github.com/<user>/<tag>/archive` seems to return the most recent version, not necessarily the version we want (the version in the filename is ignored, because GitHub doesn't care about the filename at all - it seems that if you get a tarball corresponding to a particular tag, that's just because there are no newer changes). Therefore we should request `archive/<tag>/filename-1.2.3.tar.gz`, to make sure we always get the same version.    This may explain why the shorthash spontaneously changed in https://github.com/xapi-project/xen-api-rpm-buildroot/pull/72.

The tag is included in the name of the top level directory in the tarball: `<repo>/archive/<tag>` results in a toplevel directory of `<repo>-<tag>`.   RPM assumes that a tarball for an RPM called `<name>-<version>` will unpack to such a directory and will find it automatically.   Therefore wherever possible we should use purely numeric tags to mark releases.   If we name the tags `<repo>-<tag>`, the resulting tarballs have top level directories of the form `<repo>-<repo>-<tag>`, and we need to use `%setup -n <name>` in the spec file.