external: Add `pip-app` for Python application sandboxing