ci: Separate image preparation commands

The Debian image preparation is moved to before_script to separate it
from the build and test commands. Note that this adds an implicit 5 minute
time limit on this part of the script (see
https://gitlab.com/gitlab-org/gitlab-runner/-/issues/2716).

The commands are also now written once and copied using YAML anchors
(as documented at
https://docs.gitlab.com/ee/ci/yaml/README.html#yaml-anchors-for-before_script-and-after_script).