new redirect of http://www.python.org/ to https://www.python.org.

Discovery and patch by Wenzhu Man.  University of Waterloo apparently
maps the local name 'test' to localhost, which is in the bypass list,
causing the test to fail.  So change 'test' to a name unlikely to get
mapped to localhost.

Also move NEWS item to correct position (it was in 3.3).

Also applies to cherry pick Issue #20909.

Since Victor linked to it in a block, it seems to make sense to have
all the SSLContext changes next to each other.  I also sorted all the
SSL security enhancements next to each other in the security
enhancements summary.

When running external programs such as a C compiler and getting an
error code, distutils only prints the program name.  With this change,
one can get the full command line by setting the DISTUTILS_DEBUG
environment variable.

This should have no compatibility issues, unless there are tools
that depend on the exact format of distutils debug messages.