Update ASWF Conan packages to download release URLs

[jfpanisset]

As ASWF projects transition to using sigstore-signed tarball assets, ASWF Conan recipes should be updated to use those download URLs preferentially, even if the SHA256 still needs to be pinned manually in conanfile.py

[jfpanisset]

Projects using signed tarball releases

• opencolorio
• openexr
• materialx
• imath
• openimageio
• openshadinglanguage
• rez

Projects not using signed source tarball releases

• openvdb
• openfx (uses them for binaries)
• opencue
• opentimelineio
• rawtoaces
• openrv
• xstudio
• openapv
• openqmc
• openpgl