Fix a few minor issues with the Dockerfile (both for buildability and cacheability)

So, the old `docker build` parser-wannabe handled these inline comments just fine, but the new parser from Docker master gets rightfully grumpy and treats most of the line as commented out.

Also, I moved up the `generate_cert` bits since they don't change as often (or due to any of our `COPY`'d files) so they can be cached nicely.