HTTPS: Use HTTPS when downloading JARs from Typesafe repo and repo.scala-sbt.org

By using secure URLs, people on your network are not (trivially) able to inject executable code into your dependencies to run on your computer or your build server.

Unfortunately `JavaNet2RepositoryRoot` has no `https` mirror. Is there an alternative mirror or a Scala annotation to warn users (and transitive users) that anyone could execute arbitrary code on their computers?
Could we deprecate it this release then remove it next?