Description of problem:
The subscription manager plugin for dnf has a boolean:

[main]
disable_system_repos=1

Which disables repos not defined in `redhat.repo`.

PackageKit appears to bypass this setting.

Version-Release number of selected component (if applicable):
PackageKit-1.2.4-2.el9.x86_64

How reproducible:
100%

Steps to Reproduce:
1.Install a system with subscription-manager repos
2.Set disable_system_repos=1
3.Add a repo to the system with `enabled=1` that contains updates
4.run dnf update, see no updates
5.run pkcon update, see updates

Actual results:
Updating Subscription Management repositories.
subscription-manager plugin disabled 7 system repositories with respect of configuration in /etc/dnf/plugins/subscription-manager.conf
Puppet 7 EL9 x86_64 137 kB/s | 2.5 kB 00:00
AlmaLinux 9 AppStream x86_64 147 kB/s | 2.6 kB 00:00
Fermilab Context EL9 x86_64 129 kB/s | 2.3 kB 00:00
AlmaLinux 9 BaseOS x86_64 128 kB/s | 2.3 kB 00:00
AlmaLinux 9 CRB x86_64 123 kB/s | 2.3 kB 00:00
EPEL 9 x86_64 135 kB/s | 2.3 kB 00:00
ELRepo kmods EL9 x86_64 111 kB/s | 2.0 kB 00:00
AlmaLinux 9 Extras x86_64 131 kB/s | 2.3 kB 00:00
allow_vendor_change is disabled. This option is currently not supported for downgrade and distro-sync commands
Dependencies resolved.
Nothing to do.
Complete!
[root@testhost ~]# pkcon update
Getting updates [=========================]
Finished [=========================]
Starting [=========================]
Finished [ ] (0%)
The following packages have to be updated:
fakeroot-1.30.1-1.el9.x86_64 Gives a fake root environment
fakeroot-libs-1.30.1-1.el9.x86_64 Gives a fake root environment (libraries)
puppet-agent-7.21.0-1.el9.x86_64 The Puppet Agent package contains all of the elements needed to run puppet, including ruby, facter, and hiera.
tzdata-2022g-1.el9_1.noarch Timezone data
Proceed with changes? [N/y]

Expected results:
The settings from the dnf plugin would be honored by package kit

Additional info:
Packages like `chrome` tend to force provide their own repo that it enables outside my change window and then runs updates.