Fix missing CA certificates for apt update.

The fix is installing the ca-certificates package before adding the
source files. Doing that would make the 2 build stages close enough that
it doesn't make sense anymore to have 2 build stages.