"Use HTTPS for downloading artifacts from Maven Central" + disable flag

This is an amendment to #1494. HTTPS will be enabled by default, but can be turned off using the following flag:

```
-Dsbt.repository.secure=false
```