[MEDIUM] Protect build dependency downloads with HTTPS

[OskarEichler]

Summary

Use HTTPS for every direct OpenSSL, Kerberos, PostgreSQL, and EnterpriseDB PostgreSQL archive download used by cross-build and CI packaging paths.

Urgency: MEDIUM. The PostgreSQL and EnterpriseDB HTTP endpoints currently return build inputs directly over plaintext rather than redirecting to TLS. An on-path attacker could replace a native dependency or CI test archive. The resulting files are compiled, linked into binary gems, or executed during CI.

Evidence

Focused header checks showed:

• http://ftp.postgresql.org/... returns the archive directly with HTTP 200.
• http://get.enterprisedb.com/... returns the archive directly with HTTP 200.
• The OpenSSL and Kerberos endpoints redirect from HTTP to HTTPS, but their initial request is still unauthenticated.
• Each corresponding HTTPS URL resolves successfully.

Verification

• rbenv exec ruby -c ext/extconf.rb
• Both changed workflow files parse successfully with Ruby/Psych.
• HTTPS header checks for all four download hosts succeeded.
• git diff --check

Scope and compatibility

This changes transport only. Versions, archive names, build flags, and workflow behavior remain unchanged.

Breaking-change note: none expected. Environments unable to establish TLS to these upstream hosts will need working CA trust rather than falling back to plaintext downloads.