CVE-2019-5736: runc container breakout

Flatpak versions older than 1.2.3 and 1.0.7 are thought to be vulnerable to a similar attack (CVE-2019-8308), although only in narrow circumstances: when an app or runtime with an `apply_extra` script is installed system-wide, the `apply_extra` script runs as root in a container, and could escape the container by using a similar technique.