Prefer HTTPS urls where available, especially for resolvers!

[SBT 0.13.6 defaults to HTTPS for Maven Central](https://groups.google.com/d/msg/sbt-dev/BBKDh2h56ww/XHChyFNnvFwJ), so the bar for reasonable security has been nudged upwards :lock: