Make BrandingInstaller run every cert install/rm

Instead of just running on ent cert installation, now run
whenever we make changes to the contents of the ent dir
via certlib.UpdateAction.perform.

This let's us potentially catch pure cert deletions that
could change branding (for ex, previously two ents providing
conflicting brand info results in no brand changes. Now we
check again if one of those ents is removed, and would detect
that there is not valid branding info and install it).

This means BrandsInstaller gets ran more often, but it will
catch more corner cases. This will also catch cases where
installed product ids change, if they impact compliance
and branding. The next ent cert dir update will trigger any
needed branding updates.

RHELEntBranding* now looks for ent certs from the injected
ENT_DIR by default.

Remove ent dir file monitoring, since we run in certlib.update
now.
Make certlib repo and brand updating similar.

Move repolib update into a repo_hook, and invoke repo_hook
and branding_hook from the same place.

Move certlib update result logging to before repo/brand hooks,
since it does happen first.