feat(sandbox): implement bubblewrap for common apps

[aenriii]

communication apps, steam, etc. anything chromium/CEF gets a bubblewrap so i can enable userns and disable hardened-malloc (via unsetting LD_PRELOAD) to assure these apps dont Blow Up