Switch download urls to https

This is not strictly necessary because of the PGP signature, but it does
not hurt to be overly cautious.

Signed-off-by: Richard Yao <richard.yao@clusterhq.com>