Close a security hole by using https to fetch artifacts

Close a security hole by using https to fetch artifacts instead of http. Should never download software over http. See http://blog.ontoillogical.com/blog/2014/07/28/how-to-take-over-any-java-developer/

There are two that I didn't update here
http://repo.scala-sbt.org/scalasbt/sbt-plugin-snapshots is not available via https :-(
https://github.com/playframework/playframework/pull/3286 just added one that I wasn't 100% sure how to test if https would work