Implement *basic* file handle transfer

We open a file descriptor outside of the sandbox within iportald,
and then transfer that file descriptor to the sandboxed client
application, enabling them to read the file (read only) via a
GMappedFile interface. This is all very basic right now and needs
to be fixed into an API.