support for alternative download locations with authentication

[oliverlee]

At my day job, we've had to patch toolchains_arm_gnu to use an alternative download location to prevent rate-limiting from the default download location. Would you be open to allowing users to customize the archive download location and to support netrc-based authentication?

I can probably prepare a PR early next week if you would be okay with this.