helper: Bind mount /sys subset
helper: Bind mount /sys subset

Instead of mounting our own sysfs instance we bind mount in only
a subset of the /sys subdirectories from the host. This has several
advantages:

* If something was covered out in the host we will shadow that (i.e.
  the app will never see more of sysfs than non xdg-apps)
* We can avoid showing some weird parts of sysfs, focusing on the
  device descriptions needed for e.g. mesa
* Bind mounts are allowed in a non-root user-namespace, whereas
  the sysfs mount is not, taking us one step closer to that.

amigadave/flatpak,alexlarsson/xdg-app,GeorgesStavracas/flatpak,thiblahute/xdg-app,amigadave/flatpak,chergert/xdg-app,GeorgesStavracas/flatpak,matthiasclasen/xdg-app,matthiasclasen/xdg-app,handsome-feng/flatpak,flatpak/flatpak,handsome-feng/flatpak,matthiasclasen/flatpak,alexlarsson/xdg-app,matthiasclasen/flatpak,matthiasclasen/xdg-app,GeorgesStavracas/flatpak,flatpak/flatpak,thiblahute/xdg-app,handsome-feng/flatpak,handsome-feng/flatpak,GeorgesStavracas/flatpak,matthiasclasen/flatpak,thiblahute/xdg-app,flatpak/flatpak,alexlarsson/xdg-app,flatpak/flatpak,flatpak/flatpak,matthiasclasen/flatpak,chergert/xdg-app,amigadave/flatpak,handsome-feng/flatpak,chergert/xdg-app,thiblahute/xdg-app,amigadave/flatpak,matthiasclasen/xdg-app,GeorgesStavracas/flatpak,matthiasclasen/flatpak,chergert/xdg-app,alexlarsson/xdg-app