Further refactoring towards Flatpak sub-sandboxing support

• runtime: Allow bwrap, exports to be NULL when using a mutable sysroot

  In the case where we use Flatpak sub-sandboxing, we're not going to be building a bubblewrap command-line at all. Luckily, when we make use of a mutable sysroot, we don't need it.

  This requires splitting bind_runtime(), which consists of

  • a part that builds up the basic bwrap command-line and environment variables before setting up the graphics stack (now bind_runtime_base())
  • setting up the graphics stack by either building a bwrap command-line or editing the mutable sysroot, and in either case setting environment variables (pv_runtime_use_provider_graphics_stack())
  • a final part that sets the last few bwrap arguments and exports (bind_runtime_finish(), which can't currently fail)

• wrap: Only serialize the locked environment variables if using --launcher

  If we are not using the --launcher, then there's no point in setting this up: they won't be used for anything anyway.

• wrap: Exit cleanly if asked to run in Flatpak without a mutable copy

  We always need a mutable copy of the runtime when running in Flatpak, because we are unable to run bwrap to do container setup.

• wrap: Log a message for disabled Steam Overlay before checking existence

  This refactoring will be helpful when running in Flatpak.

• wrap: Only serialize the locked environment variables if using --launcher

  If we are not using the --launcher, then there's no point in setting this up: they won't be used for anything anyway.

• wrap: Exit cleanly if asked to run in Flatpak without a mutable copy

  We always need a mutable copy of the runtime when running in Flatpak, because we are unable to run bwrap to do container setup.

• wrap: Log a message for disabled Steam Overlay before checking existence

  This refactoring will be helpful when running in Flatpak.

• wrap: Append argv in container directly to final argv

  Instead of this pseudocode:

    bwrap += argv_in_container
    final_argv += bwrap

  if we do this:

    final_argv += bwrap
    final_argv += argv_in_container

  it will be easier to adapt to Flatpak sub-sandboxing, in which we never directly build up a bwrap command-line and so bwrap remains NULL.

  This means that in the case where we are escaping from a Flatpak sandbox to run commands on the host, we have to forward the fds from argv_in_container in addition to the fds from bwrap.

• wrap: Re-indent some blocks that will not apply when sub-sandboxing

  This will reduce the diff in later commits that actually change logic, hopefully making them easier to review.

  Best reviewed with git diff --ignore-space-change or similar.

---

As always, this is best reviewed commit-by-commit.