Add an environment variables locking system

Instead of listing all the environment variables that we want to copy into the new pressure-vessel sandbox (whitelist), we can use a list of environment variables that we change and another one for the variables that we don't want to copy (blacklist). Then, if we execute pressure-vessel-launch with the option --pass-env-matching '*', all the environment variables left will be copied in the new container.

Fixes: #17 (closed)

I'll do some more testing to double check if the list of variables that I wrote is exhaustive.

Right now the vars filtering is unavoidable. I thought about adding a launch option switch to disable it but in the end I didn't do it because, if we copy every environment variables without the hadcoded blacklist, it probably simply won't work at all.

/cc @smcv

EDIT: Related MR https://gitlab.steamos.cloud/steam/steamlinuxruntime/-/merge_requests/18