lzo's download server does not present a valid certificate, so that downloads via https are failing. Spack's MD5 checksum still ensure a safe download. Closes #1675.