minimal: Exclude iptables-legacy, don't include iptables-nft

Motivated by trimming the package set of minimal to be smaller
to match its name.

But more generally, I think the solution most of the time we hit a
"multiple things have a provides" isn't to hardcode what we want,
but to exclude what we don't want.

Ideally of course...there'd be something like
`ProvidesDisfavored: iptables` that `iptables-legacy` could
use.

Signed-off-by: Colin Walters <walters@verbum.org>

minimal/bootc.yaml

@@ -2,15 +2,15 @@
 packages:
  - systemd
  - bootc
- # bootc pulls in podman, which pulls in containers-common, which wants
- # `iptables`. Currently that pulls in iptables-legacy. Let's explicitly name
- # iptables-nft instead to satisfy it.
- - iptables-nft
  # Required by bootc install, sgdisk has been replaced by Rust crate
  # in bootc https://github.com/containers/bootc/pull/775
  - xfsprogs e2fsprogs dosfstools
 
 exclude-packages:
+  # bootc pulls in podman, which pulls in containers-common, which wants
+  # `iptables`. That may pull in iptables-legacy which we don't want;
+  # we want iptables-nft to win the Provides by default
+  - iptables-legacy
   # Exclude kernel-debug-core to make sure that it doesn't somehow get
   # chosen as the package to satisfy the `kernel-core` dependency from
   # the kernel package.