4.16 branched so bump the version in main development to 4.17.

That directory is part of the image and so not owned by us. Likely the
base image used for the src container was updated recently to include
newer git.

The cri-o rebuild for 4.17 is blocked on some buildroot issues. Let's
denylist it for now to unblock setting up the 4.17 stream.

The latest selinux-policy breaks ISO tests:
openshift#1514

Pin to the previous working version for now.

To do this, introduce a new `overrides-c9s.yaml` manifest that we can
use going forward when we need to pin to older versions.