Npm.require: Allow arbitrary http(s) URLs with SHA

We'll probably revisit this when we build out the package server, but
this is a relatively safe start that removes our GitHub-specific check.

Fixes #1686. (This doesn't technically fix the case in that bug but if
you know what you're doing you can add the SHA yourself.)