ci: Enable composefs sealed UKI tests on centos-9

With V1 EROFS as the default, sealed UKIs are now viable on CentOS-9.
Replace the blanket composefs exclusion for centos-9 with targeted
exclusions for the modes that still don't work: BLS (needs newer
dracut) and unsealed composefs.  This leaves composefs + sealed + UKI
enabled.

Signed-off-by: Colin Walters <walters@verbum.org>

Author: cgwalters

.github/workflows/ci.yml

@@ -225,9 +225,14 @@ jobs:
         seal_state: ["sealed", "unsealed"]
 
         exclude:
-          # https://github.com/bootc-dev/bootc/issues/1812
+          # centos-9 composefs: only sealed UKI is supported (V1 EROFS).
+          # BLS and unsealed modes require newer dracut/systemd features.
           - test_os: centos-9
             variant: composefs
+            boot_type: bls
+          - test_os: centos-9
+            variant: composefs
+            seal_state: unsealed
           - seal_state: "sealed"
             boot_type: bls
           - seal_state: "sealed"