Better mounting

This properly pivot_roots so that the standard host mounts are
not visible in the mount namespace (only the bind mounts). It also
fixes the runtime and app mounts to be readonly.
Bind mount in X11 socket
Make root tmpfs nosuid
Clean up root creation to single data source
Add our own /run mount
Mount /dev, /proc and /sys ourselves
Clean up error messages
Simplify mounts
Bindmount /dev/dri if available