According to the docs, this is frowned upon, as upgrading essential
packages might fail inside an unprivileged container.

That's a non-issue in our cases, as we're using privileged containers.

Further, we want to achieve the best of both worlds: we want to leverage
a build cache, to reduce build times, but, at the same time, we want to
pull in upgraded packages, in case the packages in question are already
installed.

This change should help with exposing errors like the one reported in
jvoisin/mat2#136 earlier in the future.