cliwrap: only wrap dnf and kernel-install

All we really want to cliwrap is `dnf` so that a `dnf install ...` will
work. Again, as mentioned in the commit that introduced this, ideally we
can actually ship dnf itself once it's ready and then we can back this
out.

Also wrap `kernel-install` for now to make kernel replacements smoother
until we can get it to work seamlessly (this matches [[1]]).

[1]: CentOS/centos-bootc#377

manifests/cliwrap.yaml

@@ -1,2 +1,5 @@
 # https://github.com/coreos/fedora-coreos-tracker/issues/730
-cliwrap: true
+cliwrap-binaries:
+  - dnf
+  # until https://github.com/coreos/rpm-ostree/issues/4726
+  - kernel-install