ci: Move subproject download and update over to a separate job
Transient DNS issues in our infrastructure make this step of our CI pipeline randomly fail. We don't want to retry the whole job, so we should see if we can put the subprojects into a separate job that other jobs can depend on.