sandbox: native container tooling

This should eventually replace bwrap.

Signed-off-by: Ophestra <cat@gensokyo.uk>

flake.nix

@@ -140,6 +140,7 @@
                 gcc
                 pkg-config
                 wayland-scanner
+                bubblewrap
               ]
               ++ (
                 with pkgs.pkgsStatic;