gitlab-ci: always use apt with with https://

This forces the apt sources to HTTPS, then ignores the certificate error since ca-certificates is not installed. After ca-certificates is installed, then the certificate checking is re-enabled.

This is admittedly a minor thing, but I think it is worth doing because it makes it a lot harder to profile the production deployserver to track it down. Basically, this hides the packages it is downloading from the network observer.