Auto-wrap `kernel-install` if layering kernel packages

[jlebon]

Basically right now, we have rpm-ostree cliwrap install-to-root / in the hot path for anyone who wants to swap kernels during derivation. The problem is that the cliwrap stuff lingers into the image, which introduces an unwanted diff wrt other nodes and causes real issues.

Until we have #4726, let's just in the layering code detect if:

• we're in the container flow, and
• there's a kernel package in the transaction, then
• wrap kernel-install before running dnf_context_run() and unwrap it afterwards

Then, we should be able to drop the cargo-culted rpm-ostree cliwrap install-to-root everywhere.