Stop disabling WebKitGTK bubblewrap sandbox
Currently we build WebKitGTK with -DENABLE_BUBBLEWRAP_SANDBOX=OFF because (a) it doesn't work under flatpak, and (b) we don't have bubblewrap or xdg-dbus-proxy in Platform.
Now that we build VM images, the sandbox is desirable there, so we should add bubblewrap and xdg-dbus-proxy. We don't want them in the flatpak runtime, though, because they're useless there. We should use split rules to ensure they're only included in the VM image.
WebKitGTK will disable the bubblewrap sandbox at runtime when running under flatpak, so that shouldn't be a problem.