Enable automatic bootloader updates

[jlebon]

Currently, Fedora CoreOS (and in fact, all other rpm-ostree-based Fedora variants) do not update the EFI bootloader together with host updates. The reason for this is explained in greater details in the bootupd README (see especially the Q&A). Recently, we've hit more and more issues related to stale bootloaders, to the point where it's becoming more urgent that we fix this gap.

The main blocker to have automatic bootloader updates is to make them safer in bootupd (related issues: coreos/bootupd#440, coreos/bootupd#454). Once it's deemed safe enough to turn on by default, we then need to integrate it into FCOS. Fedora IoT and Fedora Silverblue likely will also want this.

[bgilbert]

We should also consider whether to automatically update the BIOS bootloader. It's probably infeasible to do that safely, though.