move signing hooks to downloader layer

Vagrant's `authenticate_box_url` hook only affects metadata URLs and box
URLs obtained from a metadata URL--not simple, standalone boxes. Move
signing hooks to the curl downloader layer via monkey-patching to
intercept *all* HTTP downloads.