nco: 4.9.0 -> 4.9.1

palemoon: 28.7.2 -> 28.8.0

mixxx: 2.2.2 -> 2.2.3

blender: 2.81 -> 2.81a

It has been explained to me that cros-omahaproxy reports which
versions are available to users, while cros-updates-serving reports
the latest builds available for each channel.  The latter is probably
better for our use case anyway, and apparently, while both aren't
officially supported, is less likely to randomly break.

So let's use that instead, even if it is much more annoying to parse.

Replaced src munging with a custom unpackPhase because the previous
approach couldn't handle a newly introduced path with a space, and
this is cleaner anyway (but was impossible at the time due to
unpackPhase not being forwarded to fetchcargo).