ROX-27350: Fix task execution by removing dnf upgrade from tasks

[msugakov]

Description

I was a bit too quick to switch images in task steps from UBI8 to UBI9 in #3. Where 8 felt ok, 9 started failing because of the dnf upgrade command.

E.g. in this run https://console.redhat.com/application-pipeline/workspaces/rh-acs/applications/acs/pipelineruns/scanner-db-on-push-9qsrm

From the task log:

step-determine-image-tag
Updating Subscription Management repositories.
[...]
================================================================================
 Package           Arch       Version               Repository             Size
================================================================================
Upgrading:
 libsemanage       x86_64     3.6-2.1.el9_5         ubi-9-baseos-rpms     120 k
 p11-kit           x86_64     0.25.3-3.el9_5        ubi-9-baseos-rpms     536 k
 p11-kit-trust     x86_64     0.25.3-3.el9_5        ubi-9-baseos-rpms     144 k
 python3           x86_64     3.9.21-1.el9_5        ubi-9-baseos-rpms      30 k
 python3-libs      x86_64     3.9.21-1.el9_5        ubi-9-baseos-rpms     8.1 M
 shadow-utils      x86_64     2:4.9-10.el9_5        ubi-9-baseos-rpms     1.2 M

[...]
Running transaction
  Preparing        :                                                        1/1 
  Upgrading        : python3-libs-3.9.21-1.el9_5.x86_64                    1/12 
  Upgrading        : python3-3.9.21-1.el9_5.x86_64                         2/12 
  Upgrading        : p11-kit-0.25.3-3.el9_5.x86_64                         3/12 
  Upgrading        : libsemanage-3.6-2.1.el9_5.x86_64                      4/12 
  Upgrading        : shadow-utils-2:4.9-10.el9_5.x86_64                    5/12Error unpacking rpm package shadow-utils-2:4.9-10.el9_5.x86_64
 
  Upgrading        : p11-kit-trust-0.25.3-3.el9_5.x86_64                   6/12 
error: unpacking of archive failed on file /usr/bin/newgidmap;6762b7fa: cpio: cap_set_file failed - Operation not permitted
error: shadow-utils-2:4.9-10.el9_5.x86_64: install failed

Here the upgrade of shadow-utils fails because it cannot overwrite /usr/bin/newgidmap (that's despite the container being executed as root). My scientific guess (guessing because the proper repro will take a couple hours I don't really want to invest in it) after reading this issue is that there's some special restriction on /usr/bin/newgidmap due to how Konflux/Tekton executes task steps. This restriction results in the error during the shadow-utils upgrade attempt. We've not seen this on 8 because likely there were just no shadow-utils upgrades there.

We don't actually need dnf upgrade for proper functioning of our tasks and the (relative) freshness of packages will be ensured by Renovate updating base images. Hence, my suggestion is to stop dnf upgrade-ing in tasks.

Testing

Used bundle from this PR in stackrox/scanner#1742 and our custom tasks succeeded there.

[msugakov]

#7 is required to address the failing pipeline here before merging. I can address it with a rebase once that PR gets merged. This shouldn't block reviewing this #9.

[msugakov]

/retest acs-konflux-tasks-on-push