ROX-27840: prefetch RPM dependencies for Konflux

[tommartensen]

How to reproduce the lockfile: https://spaces.redhat.com/display/StackRox/How+to+prefetch+RPMs+for+ACS+Konflux+builds

Required changes:

• cannot blanket dnf upgrade, because we need to specify which RPMs to prefetch. Target RPMs can be added to the packages section for prefetching, see https://github.com/stackrox/scanner/pull/1793/files for an example (added to the How-to).
• The lockfile tool cannot resolve ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG}, thus changing that to the full image name. We haven't used build arg overrides anyway.
• The repo definitions file ends with 2 empty lines, because we edit it with Python's configparser which intentionally adds them: https://bugs.python.org/issue32917.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci]

@tommartensen: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-tests	0f5fdb5	link	false	/test e2e-tests

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.