set VirtualBox MASTER_SITES to download.oracle.com

The SSL certificate of the host does not have download.virtualbox.org
in it's SubjectAltName anymore (download.virtualbox.org points to the
same CDN and is the same host as download.oracle.com, and checksums still
match).

Reported by: Duncan Young