Use secure URLs when downloading executable code

By using secure URLs, people on your network are not (trivially) able to inject executable code into your dependencies to run on your computer or your build server.

Unfortunately `JavaNet2RepositoryRoot` has no `https` mirror. Is there an alternative mirror or a Scala annotation to warn users (and transitive users) that anyone could execute arbitrary code on their computers?
We actually don't have a legitimate SSL certificate here yet, which breaks on some JDKs, unfortunately.  We're still waiting on a scala-sbt.org SSL cert, but once that's here we could merge this.