c9s: pin selinux-policy-38.1.36-1.el9

The latest selinux-policy breaks ISO tests:
openshift#1514

Pin to the previous working version for now.

To do this, introduce a new `overrides-c9s.yaml` manifest that we can
use going forward when we need to pin to older versions.

(cherry picked from commit 455ea2a)

c9s-mirror.repo

@@ -0,0 +1,35 @@
+# These are the official c9s repos. They are slower to update, but contain older
+# versions of packages, which is useful when pinning for lack of a "coreos-pool"
+# equivalent. They are unused when no pinning is needed.
+
+[c9s-baseos-mirror]
+name=CentOS Stream 9 - BaseOS
+baseurl=http://mirror.stream.centos.org/9-stream/BaseOS/$basearch/os
+gpgcheck=1
+repo_gpgcheck=0
+enabled=1
+gpgkey=file:///usr/share/distribution-gpg-keys/centos/RPM-GPG-KEY-CentOS-Official
+
+[c9s-appstream-mirror]
+name=CentOS Stream 9 - AppStream
+baseurl=http://mirror.stream.centos.org/9-stream/AppStream/$basearch/os
+gpgcheck=1
+repo_gpgcheck=0
+enabled=1
+gpgkey=file:///usr/share/distribution-gpg-keys/centos/RPM-GPG-KEY-CentOS-Official
+
+[c9s-nfv-mirror]
+name=CentOS Stream 9 - NFV
+baseurl=http://mirror.stream.centos.org/9-stream/NFV/$basearch/os
+gpgcheck=1
+repo_gpgcheck=0
+enabled=1
+gpgkey=file:///usr/share/distribution-gpg-keys/centos/RPM-GPG-KEY-CentOS-Official
+
+[c9s-rt-mirror]
+name=CentOS Stream 9 - RT
+baseurl=http://mirror.stream.centos.org/9-stream/RT/$basearch/os
+gpgcheck=1
+repo_gpgcheck=0
+enabled=1
+gpgkey=file:///usr/share/distribution-gpg-keys/centos/RPM-GPG-KEY-CentOS-Official

manifest-c9s.yaml

@@ -13,6 +13,7 @@ variables:
 include:
   - common.yaml
   - packages-openshift.yaml
+  - overrides-c9s.yaml
 
 # Starting from here, everything should be specific to SCOS
 

overrides-c9s.yaml

@@ -0,0 +1,12 @@
+# This is a poor man's version of an override lockfile for c9s. When needed, we
+# can enable the mirror repos here (which hold older RPMs) and list the NEVRs
+# we need in the `packages` section. When not needed. Empty or comment out this
+# file (except this comment).
+
+repos:
+  - c9s-baseos-mirror
+  - c9s-appstream-mirror
+
+packages:
+  # https://github.com/openshift/os/issues/1514
+  - selinux-policy-38.1.36-1.el9