[RFC] Let homebrew handle external resources download

@fwalch @tarruda

Close #1388
> :-1: for this. We shouldn't let more people become vulnerable.

Well, as homebrew currently uses the CMake-based mechanism to download the dependencies, people are *already* vulnerable. It's not like this would make things worse.

Still, a separate PR to mitigate this in CMake would be good.