Add a few minor tweaks and reorganizations to improve caching and overall build

Hey @michaelneale, I had a few comments, and I figured a PR would speak louder than words in spelling out what I mean.  Feel free to fight back on any of these points if you disagree - I love a good technical debate, especially since I've been known to overlook things!

A lot of this is just moving things around to improve the build cache, but it also includes a change of specifying the GPG fingerprint of the Jenkins repo in long form so that it's not only imported, but also verified, and thus will fail at build-time if the build server has been the target of a MITM on the Jenkins repo.

This also pins the actual Jenkins install directly to the version number specified so we have more repeatable builds without unexpected version bumps that hide behind the same `.lts-version-number` file contents. :smile: