Use secure URLs when downloading executable code

By using secure URLs, people on your network are not (trivially) able to inject executable code into your dependencies to run on your computer or your build server.

Unfortunately `JavaNet2RepositoryRoot` has no `https` mirror. Is there an alternative mirror or a Scala annotation to warn users (and transitive users) that anyone could execute arbitrary code on their computers?
Thanks, sounds good to me. Also the `JavaNet2RepositoryRoot` is referenced in that file, so that also needs to get fixed.