Merge changes Idfe99d40,I3cba28cc,Ibd53cacb

* changes:
  Add rules for snapshotctl
  dontaudit update_engine access to gsi_metadata_file.
  update_engine: rules to apply virtual A/B OTA