defer root.json inclusion until image build time

[bcressey]

Currently we follow a circuitous path to get root.json into the image:

• When building any package, the PUBLISH_REPO environment variable is passed through.
• The Dockerfile uses this to select a root.json to copy into the build context.
• We also define %_cross_repo_root_json to refer to this path.
• os.spec treats this as a source file and copies it into /usr/share/updog.

From the standpoint of OOTBs, we want to keep updog independent from any prospective publisher, so root.json should be copied into the image at the last moment as part of the variant build process.