mbtools: use https to clone and add PKG_MIRROR_HASH