audit: don't warn about tarball in non-GitHub URL.