CI: minimize calls to third parties during setup/testing

I think this is a good long-term goal, actually: minimize our dependency on third parties in CI.

We go through, at least:

• CRAN (for renv.lock dependencies)
• deno.land? (the deno standard library, though I'm not sure we do this anymore)
• pip (for our requirements.txt install)
• github API (for devtools:::install("yihui/knitr"), and maybe more?)
• npm (for playwright in testing, and possibly other places as well)
• AWS (for binary dependencies)

I'd like to minimize the possible sources of failure here. I think the minimum feasible set is AWS + GitHub, and I'd be super happy with that outcome. I'm not sure how practical it is for us to solve the other ones.