test: FIPS does not setup bind mounts

[angelcerveraroldan]

On RHEL10, fips-mode-setup was removed. If the FIPS dracut module
doesn't call update-crypto-policies directly, the fips-crypto-policies
dracut module falls back to setting up read-only bind mounts over
/etc/crypto-policies, leading to issues.

Add a test assertion to verify that /etc/crypto-policies is configured
on-disk and not via bind mounts, ensuring the fix[1] in
rhel-coreos-config is working correctly.

[1] coreos/rhel-coreos-config#259

[gemini-code-assist]

Code Review

This pull request introduces a new helper method AssertCmdOutputDoesNotContain to TestCluster and utilizes it in the FIPS test to verify that there are no mounts over crypto-policies. A review comment suggests improving the helper's failure message by including the command output and using %q formatting for better debuggability.

[gemini-code-assist]

To improve debuggability when a test assertion fails, it is highly recommended to include the actual command output in the failure message. Additionally, using %q instead of %s for the command and unexpected string arguments is a Go best practice to clearly demarcate them (especially if they contain spaces or special characters).

func (t *TestCluster) AssertCmdOutputDoesNotContain(m platform.Machine, cmd string, unexpected string) {
	t.LogJournal(m, "+ "+cmd)
	outputBuf := t.MustSSH(m, cmd)
	output := string(outputBuf)
	if strings.Contains(output, unexpected) {
		t.Fatalf("cmd %q unexpectedly contained %q; output:\n%s", cmd, unexpected, output)
	}
}