Fix build-image failure on Rocky 9, occurring when the parent image does not ship the latest kernel version on the latest Rocky minor version

Add back the safety net to download package from vault. The overall package installation order is:
1. yum install -y ${!PACKAGE} (from the current mirrorlist of OS repo)
2. If (1) fails, enable vault repo as baseurl and retry the installation
3. If (2) fails, download package rpm from vault

The previous commit 6a820d7 did fix image build on older Rocky minor versions and removed the third safety net. The third safety net could be useful as described in the comment in the code

Author: hanwen-cluster

CHANGELOG.md

@@ -14,6 +14,7 @@ CHANGELOG
 
 **BUG FIXES**
 - Fix an issue where Security Group validation failed when a rule contained both IPv4 ranges (IpRanges) and security group references (UserIdGroupPairs).
+- Fix `build-image` failure on Rocky 9, occurring when the parent image does not ship the latest kernel version on the latest Rocky minor version.
 
 3.13.2
 ------

cli/src/pcluster/resources/imagebuilder/parallelcluster.yaml

@@ -87,7 +87,8 @@ phases:
                 }
                 
                 PACKAGE_LIST="kernel-headers-$(uname -r) kernel-devel-$(uname -r)"
-                [[ ! $OS =~ (rocky8|rhel8) ]] && PACKAGE_LIST+=" kernel-devel-matched-$(uname -r)"
+                Repository="BaseOS"
+                [[ ! $OS =~ (rocky8|rhel8) ]] && PACKAGE_LIST+=" kernel-devel-matched-$(uname -r)" && Repository="AppStream"
                 
                 if [[ $OS =~ rocky ]]; then
                   for PACKAGE in ${!PACKAGE_LIST}
@@ -97,6 +98,14 @@ phases:
                       sed -i 's|^#baseurl=http://dl.rockylinux.org/$contentdir|baseurl=http://dl.rockylinux.org/vault/rocky|g' /etc/yum.repos.d/*.repo
                       sed -i 's|^#baseurl=https://dl.rockylinux.org/$contentdir|baseurl=https://dl.rockylinux.org/vault/rocky|g' /etc/yum.repos.d/*.repo
                       yum install -y ${!PACKAGE}
+                    } || {
+                      # Download package from vault. Sometimes simply enabling vault is not enough if repodata index is not in vault
+                      # Using the hard-coded links to download rpm is the last safety net.
+                      # Although the following code only deal with individual packages, and doesn't have the global impact of enabling vault.
+                      # We will figure out a global safety net when needed (build failure happens again)
+                      yum install -y wget
+                      wget https://dl.rockylinux.org/vault/rocky/${!VERSION_ID}/${!Repository}/$(uname -m)/os/Packages/k/${!PACKAGE}.rpm
+                      yum install -y ./${!PACKAGE}.rpm
                     }
                   done
                 else