pipewire-pulse: add snap permissions support

SNAP containers have two main "audio" security rules:

 * audio-playback: the applications inside the container can
   send audio samples into a sink

 * audio-record: the applications inside the container can
   get audio samples from a source

Also, old SNAP containers had the "pulseaudio" rule, which just
exposed the pulseaudio socket directly, without limits. This
is similar to the current Flatpak audio permissions.

In the pulseaudio days, a specific pulseaudio module was used
that checked the permissions given to the application and
allowed or forbade access to the pulseaudio operations.
With the change to pipewire, this functionality must be
implemented in pipewire-pulse to guarantee the sandbox
security.

This patch adds support for sandboxing permissions in the
pulseaudio module, and implements support for the SNAP audio
security model, thus forbiding a SNAP application to record
audio unless it has permissions to do so.

The current code for pipewire-pulseaudio checks the permissions
of the snap and adds three properties to each new client:

 * pipewire.snap.id: contains the Snap ID of the client.

 * pipewire.snap.audio.playback: its value is 'true' if the client
   has permission to play audio, or 'false' if not.

 * pipewire.snap.audio.record: its value is 'true' if the client
   has permission to record audio, or 'false' if not.

These properties must be processed by wireplumber to add or
remove access permissions to the corresponding nodes. That
code is available in a separate patch: https://gitlab.freedesktop.org/pipewire/wireplumber/-/merge_requests/567

.gitlab-ci.yml

@@ -96,6 +96,7 @@ include:
       debhelper-compat
       findutils
       git
+      libapparmor-dev
       libasound2-dev
       libavcodec-dev
       libavfilter-dev
@@ -107,6 +108,7 @@ include:
       libgstreamer-plugins-base1.0-dev
       libsbc-dev
       libsdl2-dev
+      libsnapd-glib-dev
       libudev-dev
       libva-dev
       libv4l-dev
@@ -247,7 +249,7 @@ build_on_ubuntu:
     - .build
   stage: build
   variables:
-    MESON_OPTIONS: "-Dsession-managers=[]"
+    MESON_OPTIONS: "-Dsession-managers=[] -Dsnap=enabled"
 
 .build_on_fedora:
   extends:
@@ -274,6 +276,7 @@ build_on_fedora:
         -Dsdl2=enabled
         -Dsndfile=enabled
         -Dsession-managers=[]
+        -Dsnap=disabled
   artifacts:
     name: pipewire-$CI_COMMIT_SHA
     when: always
@@ -289,7 +292,7 @@ build_on_alpine:
     - .build
   stage: build
   variables:
-    MESON_OPTIONS: "-Dsession-managers=[]"
+    MESON_OPTIONS: "-Dsession-managers=[] -Dsnap=disabled"
 
 # build with all auto() options enabled
 build_all:
@@ -308,6 +311,7 @@ build_all:
         -Dsession-managers=[]
         -Dc_args=['-UFASTPATH']
         -Dcpp_args=['-UFASTPATH']
+        -Dsnap=disabled
   parallel:
     matrix:
       - CC: [gcc, clang]
@@ -317,7 +321,7 @@ build_with_no_commandline_options:
   extends:
     - .build_on_fedora
   variables:
-    MESON_OPTIONS: "-Dsession-managers=[]"
+    MESON_OPTIONS: "-Dsession-managers=[] -Dsnap=disabled"
   parallel:
     matrix:
       - CC: [gcc, clang]
@@ -353,7 +357,7 @@ build_release:
   extends:
     - .build_on_fedora
   variables:
-    MESON_OPTIONS: "-Dtest=enabled -Dbuildtype=release -Db_ndebug=true -Dsession-managers=[]"
+    MESON_OPTIONS: "-Dtest=enabled -Dbuildtype=release -Db_ndebug=true -Dsession-managers=[] -Dsnap=disabled"
   parallel:
     matrix:
       - CC: [gcc, clang]
@@ -367,7 +371,7 @@ build_session_managers:
     - meson compile -C "$BUILD_DIR" $COMPILE_ARGS
     - meson install -C "$BUILD_DIR" --no-rebuild
   variables:
-    MESON_OPTIONS: "-Dsession-managers=$SESSION_MANAGERS"
+    MESON_OPTIONS: "-Dsession-managers=$SESSION_MANAGERS -Dsnap=disabled"
   parallel:
     matrix:
       - SESSION_MANAGERS: ["[]", "wireplumber", "media-session", "media-session,wireplumber", "wireplumber,media-session" ]
@@ -384,7 +388,7 @@ build_meson_prerelease:
     - meson compile -C "$BUILD_DIR" $COMPILE_ARGS
     - meson install -C "$BUILD_DIR" --no-rebuild
   variables:
-    MESON_OPTIONS: "-Dsession-managers=wireplumber,media-session"
+    MESON_OPTIONS: "-Dsession-managers=wireplumber,media-session -Dsnap=disabled"
   allow_failure: true
 
 build_meson_exact_release:
@@ -402,7 +406,7 @@ build_meson_exact_release:
     - meson compile -C "$BUILD_DIR" $COMPILE_ARGS
     - meson install -C "$BUILD_DIR" --no-rebuild
   variables:
-    MESON_OPTIONS: "-Dsession-managers=[]"
+    MESON_OPTIONS: "-Dsession-managers=[] -Dsnap=disabled"
 
 valgrind:
   extends: