Release 0.4: make https protocol as default one for a new packages

[wildart]

Start a gradual transition to a new https-only package manager (METADATA/3601).

[pao]

(This had been changed on master in 3e957e8.)

[felipenoris]

Also proposed at #11312

[malmaud]

Will this result in package authors who check out their own packages via Pkg.clone being asked for their Github credentials whenever they try to push changes?

[tkelman]

Likely. This is how things work already in settings where ssh keys are unavailable or not working.

[Keno]

You can use a credential helper to avoid that. It's sort of like ssh-agent for https.

[Keno]

Assuming that libgit2 supports those (Does it?).

[Keno]

Also, if you don't want to store your password, you can use github tokens, which are just as revokable as keys: https://help.github.com/articles/git-automation-with-oauth-tokens/.

[wildart]

In PkgDev, I use github user name from .gitconfig and saved 2FA token for automatic login. So, plain user/password authentication helper can be arranged.