Add initial sandbox implementation

This is currently hard-coded to launch gedit, and requires certain
features and makes certain assumptions about the host.

The /run/ mount point must be available, and is mounted in a bind
mountpoint to enable access to dbus, etc. This will require filtering
in the future, as well as device access to /dev/ nodes.