Question 01
To build IS 4.0.0 you need to build patch-release 4.0.3 But there can be some components from 4.0.0 up-to 4.0.3 but not 4.0.3+ So its better to build all main branch plus patch-release versions below your required version. As Ratha mentioned if you build online these jars will be downloaded if available.
Question 02
You need to build orbit patch-release 4.0.2 since it was used on IS 4.0.0 The reason for not having patch-release 4.0.3 version is there is no difference from 4.0.2 version. So same version is used during production.
Hope this will help you.