rework CI to generate synthetic RPMs

[cgwalters]

See #228 and #203

Basically to test upgrades, we're downgrading to an older grub build which is broken. We're just testing that the synthetic process of changing files actually works, but we're not currently testing rebooting into it.

Instead, we should download the working RPM and tweak it by:

• adding files (safe)
• Figuring out a way to mutate e.g. shim or grub binaries in a benign way that doesn't affect functionalty (this will (hopefully) not work with Secure Boot though), but at least we can reboot in non-SB UEFI

[bgilbert]

Once we have this, we can revert #228.