Move security from modifiers to required in install template

- Security is now enabled by default in all install recipes
- Add override handling to skip required fragment when modifier sets security
- Fix modifier key lookup to handle both hyphen and underscore keys

Closes #issue

recipe-generator/generate_recipe.py

@@ -243,11 +243,17 @@ class RecipeGenerator:
         modifiers = modifiers.copy()
         modifiers['version'] = version
 
+        # Keys that can be overridden by modifiers
+        override_keys = {'security'}
+
         # Add required includes
         for item in template.get('required', []):
             if isinstance(item, dict):
+                key = list(item.keys())[0]
                 fragment_path = list(item.values())[0]
-            else:
+                
+                # Skip required fragment if modifier overrides it
+                if key in override_keys and key in modifiers:
                     continue
 
                 if fragment_path not in seen:
@@ -312,7 +318,12 @@ class RecipeGenerator:
             # Normalize key: convert underscores to hyphens for template lookup
             mod_key_normalized = mod_key.replace('_', '-')
             if mod_key_normalized in template.get('modifiers', {}):
-                mod_config = template['modifiers'][mod_key_normalized]
+                mod_key_to_use = mod_key_normalized
+            elif mod_key in template.get('modifiers', {}):
+                mod_key_to_use = mod_key
+            else:
+                continue
+            mod_config = template['modifiers'][mod_key_to_use]
             
             # Handle nested dict modifiers
             if isinstance(mod_config, dict) and isinstance(mod_value, str):

recipe-generator/recipe_templates.yaml

@@ -18,6 +18,7 @@ templates:
       - packages: fragments/packages/core-group.ks
       - fedora-remix: fragments/packages/fedora-remix.ks
       - hand-picked: fragments/packages/hand-picked.ks
+      - security: fragments/core/security/enabled.ks
     optional:
       hardware-support: fragments/packages/hardware-support.ks
       guest-agents: fragments/guest-agents/base.ks