portal: Allow passing device permissions to subsandbox

[JakobDev]

This allows to pass all device permissions to a subsandbox

[GeorgesStavracas]

I think you'll need to update the portal XML comments as well

[swick]

Added the documentation and fixed some indentation so it actually gets generated. Going to merge in a few days.

[swick]

Thanks, should be all fixed.

[JakobDev]

Sorry, I forgot about this PR.

After taking another look at this, maybe we should add it as a new option in the options dict instead as a sandbox flag. The problem I see with the flag, it's a 32bit bitmask. That means we have only 32 different boolean options. If we add new permissions using the flag we might run out of available options.

[swick]

I think it's fine. If we run out we can add a sandbox-flags-ext or something to the vardict.

[JakobDev]

If we run out we can add a sandbox-flags-ext or something to the vardict.

That sounds a bit weird but OK.

IMHO there shouldn't be a bitmask in the beginning. These should be all keys in the vardict. The current system has a few problems. But we can't really drop it. I might open a Issue about it for further discussion.

I will create a PR for the flatpak-spawn cli to add the new flags when I have time.