Step 5 only rewrote the list-membership form (product in [...,"rhel8"]), so
the shared rules using the equality form (product == "rhel8") fell through to
the generic else branch for almalinux8. Most visibly,
configure_custom_crypto_policy_cis dropped NO-SSHWEAKCIPHERS/NO-SSHWEAKMACS/
NO-WEAKMAC, weakening the CIS crypto remediation vs the rhel8 base (no hard
failure since NO-SHA1 still ships on EL8). Now almalinux8 follows the rhel8
branch.
Also set auto_increment on the .alma.1 release suffix.
Andrew Lukoshko
deb4aeb854