download_service: avoid unsafe URL.open()
download_service: avoid unsafe URL.open()

Instead we can pass through URL.parse.open, which isn't susceptible to
being fed "|echo oops, you were owned". In our case it's already OK; we
are feeding only a URL defined earlier in the file. However, the
files_from_sourceforge() method itself is unsafe, and a new caller could
trigger a vulnerability. So let's fix it now, which also appeases
rubocop.

git/git-scm.com,git/git-scm.com,git/git-scm.com,git/git-scm.com