depends: teach 'make download' to download sources for all hosts
depends: Move source stamps to source dir and misc cleanups

Since the last commit will force rebuilds of all depends, take the opportunity
to clean up a few other things that would trigger rebuilds as well.

- Move source stamps to the sources dir so that SOURCES_PATH is respected for
  "make download".
- Only print "fetching..." when actually downloading a file.
- Avoid using non-deterministic paths for the recipe hash (patch location).
  This should ensure that all builders get the same resulting build-ids.
- Use a per-package source paths. This will allow for removing old source files
  in the future.
- Use a host-agnostic path for downloads which gets cleaned up properly.
depends: fix packages with hard-coded SOURCES_PATH

Also fixes a nasty bug that removes the downloaded comparisontool jar file.
docs: release process fixups

Add instructions for manually fetching sources, as well as some misc. fixes.