feat(appimage): If necessary, start with --no-sandbox

[sabonerune]

fix #8440

The method in #4496 has the following drawbacks:

• Doesn't work without desktop integration
  The AppImage can be launched without desktop integration.
  It also doesn't work when started from the command line.
• Sandbox is always disabled
  user namespace should now be available on many Linux systems.
  This means that --no-sandbox is only needed in limited environments.
  Even in Ubuntu 24.04 or later, starting from file manager bypasses AppArmor restrictions, so --no-sandbox is not required.
  https://discourse.ubuntu.com/t/understanding-apparmor-user-namespace-restriction/58007#p-148026-bypassing-apparmor-security-restriction
  It's also possible that the user has disabled AppArmor.

This solves these problems by automatically detecting when the user namespace is unavailable and adding --no-sandbox at runtime.

[changeset-bot]

🦋 Changeset detected

Latest commit: d3480ac

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 8 packages

Name	Type
app-builder-lib	Major
dmg-builder	Major
electron-builder-squirrel-windows	Major
electron-builder	Major
electron-forge-maker-appimage	Major
electron-forge-maker-nsis-web	Major
electron-forge-maker-nsis	Major
electron-forge-maker-snap	Major

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[absidue]

I would suggest changing the pull request title and changelog entry, as it sounds like you are adding the --no-sandbox flag in more cases, but the goal of this pull request is to add that flag in less cases. Something along the lines of: "feat: Only start AppImage with --no-sandbox when necessary" would be more clear.

[mmaietta]

This is a breaking change for appimage toolset 0.0.0 (legacy) as it's AppRun script is hardcoded in upstream dependency app-builder-bin