move a few things around for improved cache

- separated the non-essential bits from the essential bits so that the former can be cached completely
- added an explicit pinned version for the packages from `src:r-base` so there's a natural cache-bust when it's time to update
- moved several blocks higher in the file so they can be cached completely as well
- added a default command, so that if someone does `docker run -it --rm r-base`, they're dropped straight into a useful R shell