manifest: when recording packages, ignore packages from the base image

manifest: when recording packages, ignore packages from the base image

This solves the problem that the generated package list included all packages
visible in the combined overlay when building something on top of a base image.
Instead, we want just the stuff that was added in the overlay.

I considered some other approaches:
- use 'dnf history info' to query what the last transacation was.
  The output is human-readable tabular text, and would have to be parsed.
  This could be done, but there's a bigger problem: we don't necessarilly
  know that the last transaction is all that matters. And in fact, as
  raised by mdomonko in #rpm-ecosystem, dnf is not the only way to install
  rpm packages. Using rpm directly also covers direct rpm invocations,
  which could be done from the build scripts.
- look at rpm transaction id. This still has the problem that we don't
  know if the last transaction is all that matters.

So overall, the simple time-based approach should be no worse than the other
ones, and is trivially easy to implement.