cargo: port to use requests instead of urllib

The main reason for the switch is that requests supports using credentials
from .netrc, which would require copying quite some code from
downloadablefilesource to achieve using urllib.