Distributors entering Flatpakland

Again, replacing the use of bubblewrap is in many ways the easy part (it's quite a thin wrapper around kernel APIs); the hard part is everything else (in Flatpak itself and in the portals) that's been built around it.