README: use `https` where possible