Never use dnf update -y inside of the images

[tulilirockz]

Will make bisecting errors caused because of upstream images a LOT easier. We are currently getting some issues because centos-bootc changed their rechunking to the experimental rechunking and it was a pain to figure this out

[fiftydinar]

Try using dnf -y distro-sync instead.

[tulilirockz]

We want to keep the images as close to upstream as possible. The best I found was to just do dnf update -y kernel in specific because we want the kernel security backports always

[tulilirockz]

The "just use dnf update -y kernel" approach seems to be working nicely for now