Make DownloadableFileSource clearly define public and private fields

TarSource and RemoteSource now parse url from the config themselves,
because they need it, but the url is private.