tier-0: pull in dnf5, not dnf

Currently, there is both dnf and dnf5 in Fedora. dnf5 provides `dnf`,
but matching a package name is stronger and so requesting `dnf` here
still pulls in the legacy one.

This notably drops out Python from tier 0.

tier-0/manifest.yaml

@@ -58,7 +58,7 @@ include:
 
 packages:
   # needed for building derived container images
-  - dnf
+  - dnf5
   # Even in tier-0, we have this.  If you don't want SELinux today, you'll need
   # to build a custom image.
   - selinux-policy-targeted