integrate bcvk and do actual testing

[renner0e]

What I want to do is an upgrade test, some rough thoughts on how this maybe could look like:

1. bootc install-to-disk last weeks :stable image
2. setup ssh (modify the image, don't actually enable sshd by default on builds we ship to users)

• bcvk requires sshd enabled in container image to be able to install into a disk image bootc-dev/bcvk#236
• ssh into container via VSOCK instead of via sshd.service? bootc-dev/bcvk#240

3. push that image to a staging tag like ghcr.io/get-aurora-dev/aurora:stable-x86_64 (sign with corresponding key, not ublue one)
4. upgrade to ghcr.io/get-aurora-dev/aurora:stable-x86_64 (which is the freshly built image)
5. Make some (bogus) small change to the current image to verify if we can upgrade to future images from the current image
6. actually push to a production tag like ghcr.io/ublue-os/aurora:stable if things worked out

This needs some changes on how we push our images currently (ties into #2538), ideally we would be doing tests with images on ghcr.io/ublue-os/ to mimic actual systems as close as possible (especially regarding signing and containers-policy.json).

Even if we only upgrade to images that are in the containers-storage (and are not signed), at least this would detect issues like

• SELinux blocks upgrading #1809

We should probably heavily look at what bootc does already:
https://github.com/bootc-dev/bootc/blob/main/Justfile
https://github.com/bootc-dev/bootc/blob/main/bcvk.just