use URLs from JSON API

[jonasfj]

The specification says that packages can be downloaded from:

GET <PUB_HOSTED_URL>/packages/<PACKAGE>/versions/<VERSION>.tar.gz

It says so because current versions of the pub tool has this pattern hardcoded so we had to formalize it. However, all the JSON replies from the API contains URLs for the tarball, the client should probably use these instead.

---

This is low priority, as we can't break old clients we're likely stuck supporting the old API end-point for a long time regardless.