Collapse CI Dockerfile into a single layer

Collapse CI Dockerfile into a single layer

Speed up CI Docker build: apt-get update once

This is cribbed from
https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#apt-get,
particularly the 'well-formed RUN instruction that demonstrates all the
apt-get recommendations'.

This ensures that:

- apt-get has a lot of parallelism available to speed up downloading of
  packages
- apt-get only has to read package information into memory once
  (speeding up the build)
- one single revision of the Ubuntu package sets are used by all apt-get
  installs (previously if Ubuntu updates packages between RUN commands
  we might get packages from different revisions - unlikely but
  possible)
- the /var/lib/apt/lists/* files are not present in any docker
  filesystem layer, saving space (previously they were present in all
  layers but the last layer, so the removal at the end didn't save any
  space)