third_party/sandboxroot: stabilize repo URLs

Metalink output is not stable, pin mirrors instead. We need to
set up our own caching proxy next, but this will do for now.

Change-Id: Ibc6ea9672890d88022a9310afb92db824226351d
Reviewed-on: https://review.monogon.dev/c/monogon/+/1087
Reviewed-by: Serge Bazanski <serge@monogon.tech>
Tested-by: Jenkins CI
diff --git a/third_party/sandboxroot/repo.yaml b/third_party/sandboxroot/repo.yaml
index d75de5c..e353ccc 100644
--- a/third_party/sandboxroot/repo.yaml
+++ b/third_party/sandboxroot/repo.yaml
@@ -2,8 +2,18 @@
 - arch: x86_64
   metalink: https://mirrors.fedoraproject.org/metalink?repo=fedora-37&arch=x86_64
   name: 37-x86_64-primary-repo
+  mirrors:
+    - https://ftp.fau.de/fedora/linux/development/37/Everything/x86_64/os
+    - https://ftp.halifax.rwth-aachen.de/fedora/linux/development/37/Everything/x86_64/os
+    - https://mirror.23m.com/fedora/linux/development/37/Everything/x86_64/os
+    - https://ftp.plusline.net/fedora/linux/development/37/Everything/x86_64/os
   gpgkey: https://storage.googleapis.com/monogon-infra-public/RPM-GPG-KEY-fedora-37-x86_64
 - arch: x86_64
   metalink: https://mirrors.fedoraproject.org/metalink?repo=updates-released-f37&arch=x86_64
   name: 37-x86_64-update-repo
   gpgkey: https://storage.googleapis.com/monogon-infra-public/RPM-GPG-KEY-fedora-37-x86_64
+  mirrors:
+    - https://ftp.fau.de/fedora/linux/updates/37/Everything/x86_64
+    - https://ftp.halifax.rwth-aachen.de/fedora/linux/updates/37/Everything/x86_64
+    - https://mirror.23m.com/fedora/linux/updates/37/Everything/x86_64
+    - https://ftp.plusline.net/fedora/linux/updates/37/Everything/x86_64