isolate: Update from https://github.com/NZOI/moe-cms/commit/ee98549208e24ab9e4c1ce414c09c202f96d8405

drop root privileges, use real user id to open metafile - security issue - can be used for privilege escalation attacks for users permitted

close metafile to prevent box_inside writing false data to it - see https://github.com/ronalchn/isolate-cheater
Install isolate without o+x mod.

This will help mitigate the effect of future security bugs.
Install isolate with group assigned to cmsuser.

Otherwise no one is allowed to run it besides root.