[bubblewrap] Add helper function to wrap a process recipe in FHS-like environment

[kylewlacy]

Some packages make a lot of assumptions about the root filesystem during the build. One example: libint is hard-coded to call /bin/rm, which we currently need to patch to support (for context, see #1147).

We already have a package for bubblewrap today, which should make it possible to run recipes for a build within a Linux sandbox that looks like a more ordinary distro. We should add a utility to do this, so that we have an easy way to handle libint and any other packages we encounter in the future.

Here's what a theoretical API for this could look like:

import * as std from "std";
import { bubblewrapWrap } from "bubblewrap";

const source = Brioche.download("...")
  .unpack("tar", "gzip")
  .peel();

const ubuntu2404Rootfs = Brioche.download("...");

export default function (): std.Recipe<std.Directory> {
  return std.runBash`
    ./configure
    make
    make install DESTDIR="$BRIOCHE_OUTPUT"
  `
    .pipe((recipe) => (
      // Run the Bash build script within an Ubuntu-based rootfs
      bubblewrapWrap(recipe, {
        rootfs: ubuntu2404Rootfs,
      })
    ))
    .toDirectory();
}