Currently when building an image IB needs to use certificates to authenticate.  If snapshots/templates are not used, IB uses a registered systems' certs to pull from the cdn.

If snapshots/templates are used, IB uses a service account cert.

We could switch to using a service account cert for all requests by using the latest snapshot for all red hat repos.  This could reduce some complexity, as we'd only have a single way to authenticate.

This work would likely involve changes to:

Images - to only use  a single form of auth for all red hat repositories

image-builder-crc - to transform cdn urls to snapshot urls

ref: https://github.com/osbuild/images/blob/15a7527e5745154c1e39245f2b29e7e7b46aaa78/pkg/manifest/subscription.go#L89