Add `--no-download` flag for easier/better packaging

This should address (partially) issue #76 (the pre-download step is the remaining part).

I've modified the existing test, although I'm not sure if I've done it right, but cabal test passes (both with and without `--no-net`).
Is this part necessary? Seems that blanking the urls is excessive. I worry that if I ever try and drive dependencies off the list of urls (which would be a reasonable thing to do) then it will go wrong.