Add `bootc container ukify`

[jeckersb]

This has come up in a few discussions but I don't see anywhere that we created an issue specifically for this, so here it is!

In a nutshell, right now in the sealed image build workflow we are computing some things in bash and then passing those to the ukify command to generate the UKI. Instead, bootc already knows internally how to compute most of that (or can be tweaked to do so), so the idea is to replace the direct ukify invocation with bootc container ukify which will simplify the build flow.