Use secure URLs when downloading executable code

By using secure URLs, people on your network are not (trivially) able to inject executable code into your dependencies to run on your computer or your build server.

Unfortunately `JavaNet2RepositoryRoot` has no `https` mirror. Is there an alternative mirror or a Scala annotation to warn users (and transitive users) that anyone could execute arbitrary code on their computers?
Typesafe repo is rekeyed. I am now waiting on repo.scala-sbt.org.
I am all for using HTTPS by default, but I would also like to provide an escape hatch to revert back to HTTP in case something wrong happens. See sbt/sbt@f3d71f98e486f5b5ae42fbddfb8cb2b6cd46f0e3. Could you please add `private[sbt]` method `typesafeRepositoryRoot` and `sbtPluginRepositoryRoot` similar to `centralRepositoryRoot`?