enter: Support non-root flatpak enter
enter: Support non-root flatpak enter

Assuming unprivileged namespaces works we can now user the .userns
bindmount to access the intermediate bubblewrap user namespace.

This also drops the warning about root, and make sure we drop all caps
at the end.

flatpak/flatpak,flatpak/flatpak,matthiasclasen/flatpak,matthiasclasen/flatpak,matthiasclasen/flatpak,flatpak/flatpak,matthiasclasen/flatpak,flatpak/flatpak,matthiasclasen/flatpak,flatpak/flatpak