Most of these updates is based on data from https://repology.org/,
detection based on permanent redirect from http:// to https://.

$source urls are updated when they contain $url as substring.

now that alpine-baselayout does that as symlink, we can't ship it
as directory from other packages. sudo keeps some timestamp files
there, and will create the directory if it's missing. so just
delete it from the package.