Switch from get-pip.py to ensurepip

Since:
* All versions of Python that are actively built by this repo now
  include the `ensurepip` module.
* The policy of these images is now to use the same pip version as the
  one bundled with `ensurepip` (rather than always upgrading as pip
  releases occur) to avoid breaking changes, and for parity with the
  `venv` module.
* As such, we might as well actually use `ensurepip` to install pip
  (since it installs the exact pip version we want) rather than manually
  doing the same using `get-pip.py`.

Now that the pip/setuptools versions track (or mostly track, in the case
of setuptools) the ensurepip versions, the concerns over frequent
invalidation of the Python layer no longer apply, and so the
pip/setuptools install can now be part of the Python layer, reducing
layer count by one.

This change is a no-op in terms of pip/setuptools/wheel versions,
since the pip versions being used already exactly matched the
`ensurepip` version of pip.

Closes #951.

Author: edmorley