Rationale:
- The ARM gcc compilers version > 7 are required to pass the symbol
check, but stretch provides version 6.
- CMake version >= 3.8 is required to use boost 1.64 with imported
targets (this is the current version from the depends/ subsystem), but
stretch provides 3.7.
- It seems to make the windows gitian build deterministic.
The instructions get updated accordingly. The debian VM has also been
bumped to Buster.
Depends on D4167.