fix: update CA certs before adding oneAPI repo in Dockerfile

Move the ca-certificates/nss update before copying the oneAPI repo
config, so yum doesn't try to reach the untrusted Intel repo while
updating certs.

Author: yuejiaointel

docker/x86_64/manylinux2014/Dockerfile

@@ -14,11 +14,11 @@
 
 FROM quay.io/pypa/manylinux2014_x86_64:2024-07-15-c746fd8
 
-COPY ./oneAPI.repo /etc/yum.repos.d/oneAPI.repo
-
-# Update CA certificates so Intel's oneAPI repo TLS cert is trusted
+# Update CA certificates before adding oneAPI repo (its TLS cert needs newer CAs)
 RUN yum update -y ca-certificates nss && update-ca-trust
 
+COPY ./oneAPI.repo /etc/yum.repos.d/oneAPI.repo
+
 # Install gcc-11
 RUN yum --disablerepo=epel install -y \
     devtoolset-11-gcc \