Update Mullvad Browser release prep templates to include downstream package notification/maintenance

This commit adds a config variable to override the URL for the updater.
When it is defined, a user-provided certificate will replace the
default public keys used to sign nightly builds.

Also, while we are at it, switch the git repo to HTTPS.

We also update doc/MAKEFILE.txt for previous changes with some makefile
targets.

Out binutils version adds the reloc sections by default, but NSIS does
not work with them.
So, we need to pass a flag to disable them, otherwise users with
mandatory ASLR turned on will not be able to install Tor Browser.