[antlir2][os] introduce os_matchers to simplify selections

Summary:
As we start to build CentOS 10 images, we often need to enable the same
`select` branches that were introduced for CentOS 9. This diff adds some
matcher logic macros in antlir, and demonstrates how to use it.

Going forward, I'll endeavor to fix up use cases where this makes
things simpler.

Test Plan:
```
[[email protected] /data/sandcastle/boxes/fbsource (eb6a1ac0b)]$ buck build fbcode//metalos/initrd:base-systemd --show-output
BUILD SUCCEEDED
fbcode//metalos/initrd:base-systemd buck-out/v2/gen/fbcode/9d93f6d8c08463fb/metalos/initrd/__base-systemd__/compile/subvol_symlink

[[email protected] /data/sandcastle/boxes/fbsource (eb6a1ac0b)]$ file buck-out/v2/gen/fbcode/9d93f6d8c08463fb/metalos/initrd/__base-systemd__/compile/subvol_symlink/usr/lib/systemd/systemd-executor
buck-out/v2/gen/fbcode/9d93f6d8c08463fb/metalos/initrd/__base-systemd__/compile/subvol_symlink/usr/lib/systemd/systemd-executor: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=d60ad83191d69bd53ca4ae19e0cf6f13b750dd04, for GNU/Linux 3.2.0, stripped

[[email protected] /data/sandcastle/boxes/fbsource (eb6a1ac0b)]$ file buck-out/v2/gen/fbcode/9d93f6d8c08463fb/metalos/initrd/__base-systemd__/compile/subvol_symlink/etc/systemd/system/dbus.service
buck-out/v2/gen/fbcode/9d93f6d8c08463fb/metalos/initrd/__base-systemd__/compile/subvol_symlink/etc/systemd/system/dbus.service: symbolic link to /usr/lib/systemd/system/dbus-broker.service
```

Reviewed By: sergeyfd

Differential Revision: D68103941

fbshipit-source-id: 03325dc41fab8e1f9e331e978fa6f61747578a01

antlir/antlir2/os/oses.bzl

@@ -88,3 +88,22 @@ else:
             flavor = "antlir//antlir/antlir2/flavor:none",
         ),
     )
+
+# Syntax `tuple[str, ...]` is erroneously declared invalid
+# @lint-ignore BUCKFORMAT
+def _at_least_centos(release: int) -> tuple[str, ...]:
+    match = []
+    for os in OSES:
+        if os.name == "eln":
+            # ELN is basically the newest centos, so it should always match
+            match.append(os.select_key)
+        if os.name.startswith("centos"):
+            this = int(os.name.removeprefix("centos"))
+            if this >= release:
+                match.append(os.select_key)
+
+    return tuple(match)
+
+os_matchers = struct(
+    at_least_centos = _at_least_centos,
+)