tier-0: pull in dnf using /usr/bin/dnf instead

dnf5 is currently in Fedora only, but this manifest is shared with
CentOS Stream and RHEL. Instead of requesting `dnf5`, request
`/usr/bin/dnf` instead. This will pull in dnf5 on Fedora, but dnf(4)
elsewhere.

We should be able to simplify this back to just `dnf` eventually once
dnf v4 is out of Fedora.

tier-0/manifest.yaml

@@ -55,8 +55,10 @@ include:
 packages:
   # this is implied by dependencies but let's make it explicit
   - coreutils
-  # needed for building derived container images
-  - dnf5
+  # We need dnf for building derived container images. In Fedora, this pulls
+  # in dnf5. In CentOS/RHEL, this pulls in dnf(4). We can simplify this back to
+  # just `dnf` once the `dnf` package is retired from Fedora.
+  - /usr/bin/dnf
   # Even in tier-0, we have this.  If you don't want SELinux today, you'll need
   # to build a custom image.
   - selinux-policy-targeted