I checked back with the p2 team at Eclipse and it is correct that Eclipse/STS is trying to download the compositeContent.jar URL first. But it should not stall on it, but instead fail fast and continue to look for the XML version of the composite update site. Since the access doesn't cause problems from your browser or on my machine, I am still a bit clueless why this is causing problems for some of our users.
What version of STS are you running? And what Eclipse version is used under the hood? Can you check that?