programs: gpodder: sandbox with bwrap

which we can do, now that xdg-open works correctly within sandboxes

hosts/common/programs/gpodder.nix

@@ -21,6 +21,9 @@ in {
         "--set" "GPODDER_DOWNLOAD_DIR" "~/Videos/gPodder"
       ];
     });
+    sandbox.method = "bwrap";
+    sandbox.wrapperType = "wrappedDerivation";
+    sandbox.net = "clearnet";
     # packageUnwrapped = pkgs.gpodder-configured;
     fs.".config/gpodderFeeds.opml".symlink.text = feeds.feedsToOpml wanted-feeds;