minimal: drop exclude on iptables-legacy; add test

In Fedora CoreOS we are still including iptables-legacy for now [1]
and since you can't really overwrite an `exclude-packages` entry it
means we can't update our git submodule.

We are working to get away from using a git submodule [2], but I'd
like to get ours updated in the mean time.

[1] https://github.com/coreos/fedora-coreos-tracker/issues/1818
[2] https://github.com/coreos/fedora-coreos-tracker/issues/1861

minimal/bootc.yaml

@@ -7,10 +7,6 @@ packages:
  - xfsprogs e2fsprogs dosfstools
 
 exclude-packages:
-  # bootc pulls in podman, which pulls in containers-common, which wants
-  # `iptables`. That may pull in iptables-legacy which we don't want;
-  # we want iptables-nft to win the Provides by default
-  - iptables-legacy
   # Exclude kernel-debug-core to make sure that it doesn't somehow get
   # chosen as the package to satisfy the `kernel-core` dependency from
   # the kernel package.

tests/rootfs/cases/no-iptables-legacy

@@ -0,0 +1,4 @@
+#!/bin/bash
+set -xeuo pipefail
+output=$(rpm -q iptables-legacy || true)
+grep "is not installed" <<< "$output"