ccs-flatten/flatten: more secure default wrt. exec'ing agents

Signed-off-by: Jan Pokorný <jpokorny@redhat.com>