System-wide sandboxing framework - sandbox-app-launcher

[Patrick]

I will add:
--ro-bind-try /usr/libexec /usr/libexec

Otherwise /etc/X11/Xsession.d/20torbrowser cannot see /usr/libexec/anon-ws-disable-stacked-tor/torbrowser.sh which then breaks Tor Browser.