Rapgap download location has expired hepforge certificate (since 2018)

[wdconinc]

Spack does not have a way to allow downloads from insecure locations as part of the package. This has to be done explicitly by the user on the command line. This means that rapgap installs will typically fail for all users the first time around, and only if they know to add -k will succeed.

Not sure if there is another location for official rapgap files (which are still sha256 checked so we could still verify), or if Hannes Jung would be willing to update the certificate.