helper/bwrap: pass --unshare-user when unshare everything

Bubblewrap apparently requires --unshare-user even when --unshare-all is set to apply --disable-userns. This behaviour is not clearly documented.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>

helper/bwrap/config_test.go

@@ -49,6 +49,7 @@ func TestConfig_Args(t *testing.T) {
 			},
 			want: []string{
 				"--unshare-all",
+				"--unshare-user",
 				"--disable-userns",
 				"--assert-userns-disabled",
 				"--clearenv",