This will force maven to update any cached snapshot library that it needs. While
the compile-and-unit-test job would have done this previously, the .m2 cache is
not necessarily shared between runners of these two jobs (if two different
runners pick up the jobs).

This maybe could be leading to some issues, though I'm not certain that it is a
problem. However, this seems like a fairly low weight change without much harm,
so it is worth the try.

A survey of 100 developers shows that most think this might be important to a
caching feature...

Because downloading maven dependencies every test is really a bear.

This will be added by individual services that need it, rather than blanketed
across all of them. Test jobs that do not require the aws-internal-test runner
(which runs inside the AWS VPC) can utilize the generic runners.

This should enable later parts of the pipeline to start as soon as their own
dependencies are satisfied, without waiting for the entire stage to complete.

Directly specifying the environment / only restrictions on container_scanning instead of using extends

The base rules for container_scanning seem to be trumping the extends one, so I
respecify them here in an attempt to override the GitLab defaults (especially
for the 'only' rule).

Also, store it as a variable -- mostly to reduce the length of the line, for readability

Will probably need to revisit this later, in case other cloud providers have Docker images.