Handle case of patch now knowing that a advisory is installable before system might, add sub-man refresh as part of remediation if a) the system has a template, or b) we detect this situation (probably too hard)

The result is that a remediation playbook would include a sub-man refresh before the 'dnf install' runs.