base-buster: Make sure to upgrade apt and dpkg first

The Let's Encrypt ISRG root has expired, and only recent versions of apt
support validating through the alternative chain. As the base image
we're building from is not up to date, we need to upgrade apt and dpkg
before running apt update on https sources.