Chore: Resolves #16119: Remove --no-sandbox checks in installation script

[JGCarroll]

…, deferring instead to runtime checks in AppImage stub

Background

Since upgrading to AppImage type 2 runtimes in #15043 - the AppRun script in the AppImage has been automatically applying --no-sandbox where required, independently of the .desktop script. This PR removes the checks from the installation script, meaning the list doesn't have to be adjusted in the future simplifying the complexity. Additionally benefiting security in situations where users might adjust system policy to allow unprivileged user namespaces.

Relevant AppImage Code

(run the AppImage with --AppImage-extract and then open squashfs-root/AppRun)

HAVE_NO_SANDBOX=0
for arg in "${args[@]}" ; do
  if [ "$arg" = --no-sandbox ] ; then
    HAVE_NO_SANDBOX=1
    break
  fi
done
NO_SANDBOX=()
# Use 'unshare -Ur true' as a heuristic to detect whether user namespaces are available.
# Notes:
#   - When running as root, this check will always succeed even if the sandbox configuration
#     actually relies on unprivileged user namespaces. In practice, Chrome/Electron usually
#     disables or adjusts the sandbox separately when running as root, so this probe is mostly
#     a no-op in that scenario.
#   - On minimal systems (e.g. Alpine or stripped-down containers) 'unshare' may not exist.
#     In that case the shell will return exit code 127 ("command not found"), which will cause
#     us to add '--no-sandbox'. This is an intentional fail-safe: we prefer the app to start
#     without sandboxing rather than crash on startup.
if [ $HAVE_NO_SANDBOX -eq 0 ] && ! unshare -Ur true 2>/dev/null ; then
  NO_SANDBOX=(--no-sandbox)
fi

Testing

Nice and easy;

1. run the v3.6 AppImage vs the v3.7 AppImage on a system like Ubuntu 26.04, where the --no-sandbox requirements are most prominent, via shell (without a .desktop file), showing --no-sandbox is now automatic in v3.7
2. Run the patched installation script as-is to generate a .desktop file, and that the app continues to open without --no-sandbox being required in Exec=

[personalizedrefrigerator]

This looks good to me! I've tested locally on Ubuntu 26.04 (ARM, installer patched to use a local ARM64 AppImage build).