ci: fix job image ordering

With the FDO CI templates, the first container used must
be .fdo.container-build@ubuntu which builds the actual
container the rest of the pipeline can use with
.fdo.distribution-image@ubuntu.

.fdo.container-build@ubuntu uses a static 'image:' tag for
its job base image and then pushes to the project registry.
If the first job incorrectly uses .fdo.distribution-image@ubuntu
instead, it appears to fail for MR branches because that target
uses CI_REGISTRY_USER as part of the 'image:' tag which gitlab
sets to the username of the submitter. Which of course fails
because that user has never built the image before...

Using Docker executor with image registry.freedesktop.org/<username>/modemmanager/ubuntu/20.04:2023-01-03.1 ...
Authenticating with credentials from job payload (GitLab Registry)
Pulling docker image registry.freedesktop.org/<username>/modemmanager/ubuntu/20.04:2023-01-03.1 ...

Signed-off-by: Dan Williams <dan@ioncontrol.co>

.gitlab-ci.yml

@@ -5,8 +5,8 @@ include:
     - templates/ubuntu.yml
 
 stages:
-  - precheck
   - container prep
+  - precheck
   - build
 
 .common_variables:
@@ -25,24 +25,6 @@ stages:
     LIBQRTR_BRANCH: 'main'
     LIBMBIM_BRANCH: 'main'
 
-verify-dco:
-  stage: precheck
-  extends:
-  - .fdo.distribution-image@ubuntu
-  - .common_variables
-  only:
-    - merge_requests
-  script: |
-    if [[ -n "${CI_MERGE_REQUEST_DIFF_BASE_SHA}" ]]; then
-      export COMMITS=$(git log --no-merges --format="%H" ${CI_MERGE_REQUEST_DIFF_BASE_SHA}.. | xargs)
-      for c in "${COMMITS}"; do
-        $(git log --format="%b" -1 ${c} | grep -q "^Signed-off-by: .* <.*@.*>") && rc="$?" || rc="$?"
-        if [[ rc -eq 1 ]]; then
-          echo "Commit ${c} failed DCO Signed-off-by check"
-        fi
-      done
-    fi
-
 build container:
   extends:
   - .fdo.container-build@ubuntu
@@ -88,6 +70,24 @@ before_script:
         popd
       fi
 
+verify-dco:
+  stage: precheck
+  extends:
+  - .fdo.distribution-image@ubuntu
+  - .common_variables
+  only:
+    - merge_requests
+  script: |
+    if [[ -n "${CI_MERGE_REQUEST_DIFF_BASE_SHA}" ]]; then
+      export COMMITS=$(git log --no-merges --format="%H" ${CI_MERGE_REQUEST_DIFF_BASE_SHA}.. | xargs)
+      for c in "${COMMITS}"; do
+        $(git log --format="%b" -1 ${c} | grep -q "^Signed-off-by: .* <.*@.*>") && rc="$?" || rc="$?"
+        if [[ rc -eq 1 ]]; then
+          echo "Commit ${c} failed DCO Signed-off-by check"
+        fi
+      done
+    fi
+
 build-no-qmi:
   stage: build
   extends: