kernel-args: add Before=boot-complete.service

For units that require creating rpm-ostree transactions, there is
a risk of failing if there are other rpm-ostree transactions
taking place at the same time. Order these karg services before
`boot-complete.service` to ensure that we run early enough so that
other services (e.g. `zincati.service`) or user commands won't
cause this unit to fail.

This was noticed in coreos/zincati#588.

modules/ROOT/pages/kernel-args.adoc

@@ -109,6 +109,10 @@ systemd:
         # We run after `systemd-machine-id-commit.service` to ensure that
         # `ConditionFirstBoot=true` services won't rerun on the next boot.
         After=systemd-machine-id-commit.service
+        # Since this unit creates an rpm-ostree transaction, we run before
+        # `boot-complete.service` to ensure that there are no other conflicting
+        # transactions that might cause this unit to fail.
+        Before=boot-complete.service
         ConditionKernelCommandLine=!systemd.unified_cgroup_hierarchy
         ConditionPathExists=!/var/lib/cgroups-v1-karg.stamp
 
@@ -154,6 +158,10 @@ systemd:
         # We run after `systemd-machine-id-commit.service` to ensure that
         # `ConditionFirstBoot=true` services won't rerun on the next boot.
         After=systemd-machine-id-commit.service
+        # Since this unit creates an rpm-ostree transaction, we run before
+        # `boot-complete.service` to ensure that there are no other conflicting
+        # transactions that might cause this unit to fail.
+        Before=boot-complete.service
         ConditionKernelCommandLine=!mitigations=off
         ConditionPathExists=!/var/lib/cpu-mitigations-karg.stamp