Draft: Disable unprivileged userns and make bwrap setuid root

segfaultrequested to merge
15725-disable-unprivileged-userns into stable

A setuid bwrap binary is more secure than allowing unprivileged user namespaces and still good enough for sandboxing purposes.

Closes #15725 (closed)

Edited by segfault

Merge request reports