Run gstreamer in a sandbox

[DemiMarie]

We can use bubblewrap to run the various gstreamer components in a tight sandbox based on seccomp and namespaces. This helps ensure that if an attacker does manage to exploit a vulnerability in gstreamer, it will be difficult to cause further damage.

[ElliotKillick]

That's definitely a good idea. I've heard about (and used) sandboxes such as firejail in the past, but never bubblewrap. However, after reading the bubblewrap README, it appears to allow for superior isolation and is the better choice.

[DemiMarie]

Bubblewrap has a --die-with-parent feature, which can avoid the need for #11.