security/xml-security: Update MASTER_SITES

Use a direct URL to Apache's release archive site as it's not mirrored
by upstream mirror sites

Approved by: ale (port maintainer), arrowd (mentor)
Differential Revision: https://reviews.freebsd.org/D32418