add landlock sandbox

[valoq]

New version of #723

This PR adds landlock filesystem isolation to ouch as discussed in #722
With the new smart unpack by default feature, this is now easy to apply.

Since this is a major feature change and can easily break things, I say this should wait until after a new release has been made and then it can be merged sit in the repo for contributors to test for a while

[valoq]

This PR is now pretty much ready to be tested in practice by anyone interested.

There are still have a few things I want to clean up in the unit tests but the sandbox code itself should be complete now.
The kernel requirement is >= 6.12 and the sandbox isolates the file system not just against file manipulation but also prevents execution and network access.

[valoq]

@marcospb19 This should also be ready to merge now.
Since it has still a decent chance of breaking things, I would suggest a new minor release with the recent commit before merging this into main, so it can sit there for a bit while more users test it.

[marcospb19]

I messed up a merge conflict, trying to solve it right now.

[marcospb19]

I'm fixing by resetting to your last good commit, and running a rebase against origin/main, that's why the force push.