Prefer ftp.gnome.org over download.gnome.org

download.gnome.org is served over SSL, but the download itself is not.
See: https://github.com/Homebrew/homebrew/pull/28026#issuecomment-39210557
libcanberra: remove explicit xz build dep