s/generic_user_content/user_home_content

Apparently, generic_user_content has specific and different meaning.
evince style
evince_decompress

Instead of returning to user domain to run decompression utils, use a
dedicated, unprivileged domain.
dontaudit xattr for pcmanfm

afaicts, pcmanfm does not display xattrs, so this boolean was useless.
xephyr_isolate_from_root

Having just one domain for nested xephyr instances makes the xnested sandboxing
method of limited utility when used for more than a few sensitive apps.

So, here is a smaller template that only constrains apps from the root xserver.
Making specific xephyr domains is left to other means.

I intend to make a template for such domains in the future, but not for now.
adapt pcmanfm domtrans if to role-specific template
user applications and downloads ifs
menu-cache policy
libfm ifs
style