buildserver auto install

Google is pushing gradle towards downloading all the SDK components that it needs, rather than having a preconfigured SDK installed. The buildserver strongly supports the old model, with added checksum checking even. We can still support the old model by pre-configuring the SDK and locking it down as root. This can then also support the new model by setting the file perms so that new packages can be auto-installed, but they cannot overwrite any packages that come pre-installed and pre-verified.

This also allows the build server to use Debian mirrors with HTTPS.