fix(default-flatpaks): don't run any flatpak commands for system users

Having any flatpak data on a system user (like sddm) fills the journal with pointless error messages due to a conflict with systemd-tmpfiles (`/usr/share/tmpfiles.d/sddm.conf`). A hacky fix I came up with is adding this to systemd units: ```conf [Unit] ExecCondition=test "$(id -u)" -ge 1000 ``` Journal snippet: ```log Jan 14 21:13:28 fedora systemd-tmpfiles[844]: Refusing to set permissions on hardlinked file /var/lib/sddm/.local/share/flatpak/repo/objects/aa/7747fd1f6743e4f1b9eae0490548f1ea2960998099a6d842443803f9b2adac.file while the fs.protected_hardlinks sysctl is turned off. Jan 14 21:13:28 fedora systemd-tmpfiles[844]: Refusing to set permissions on hardlinked file /var/lib/sddm/.local/share/flatpak/repo/objects/aa/0b0619bd1de8ed22bc554b629f40dfe1c3232e05d83579efb9c804d27e62dc.file while the fs.protected_hardlinks sysctl is turned off. Jan 14 21:13:28 fedora systemd-tmpfiles[844]: Refusing to set permissions on hardlinked file /var/lib/sddm/.local/share/flatpak/repo/objects/aa/88e5f96c210616df099d40e75882459c815d63d929e628ce1f6c96d0119ab5.file while the fs.protected_hardlinks sysctl is turned off. Jan 14 21:13:28 fedora systemd-tmpfiles[844]: Refusing to set permissions on hardlinked file /var/lib/sddm/.local/share/flatpak/repo/objects/aa/52eb93ecf20f745bee9e1ae051ad66dd169deba8b789b3822a7dba20ce9ef0.file while the fs.protected_hardlinks sysctl is turned off. Jan 14 21:13:28 fedora systemd-tmpfiles[844]: Refusing to set permissions on hardlinked file /var/lib/sddm/.local/share/flatpak/repo/objects/aa/f6f5aef98590896b55fa675249a4f5ea2d44b01011c95e6c026bdf02ae1986.file while the fs.protected_hardlinks sysctl is turned off. Jan 14 21:13:28 fedora audit[844]: AVC avc: denied { read } for pid=844 comm="systemd-tmpfile" name="protected_hardlinks" dev="proc" ino=6327 scontext=system_u:system_r:systemd_tmpfiles_t:s0 tcontext=system_u:object_r:proc_security_t:s0 tclass=file permissive=0 Jan 14 21:13:28 fedora audit[844]: SYSCALL arch=c000003e syscall=257 success=no exit=-13 a0=ffffffffffffff9c a1=7ffed3773b70 a2=80100 a3=0 items=0 ppid=1 pid=844 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-tmpfile" exe="/usr/bin/systemd-tmpfiles" subj=system_u:system_r:systemd_tmpfiles_t:s0 key=(null) Jan 14 21:13:28 fedora audit: PROCTITLE proctitle=73797374656D642D746D7066696C6573002D2D637265617465002D2D72656D6F7665002D2D626F6F74002D2D6578636C7564652D7072656669783D2F646576 Jan 14 21:13:28 fedora audit[844]: AVC avc: denied { read } for pid=844 comm="systemd-tmpfile" name="protected_hardlinks" dev="proc" ino=6327 scontext=system_u:system_r:systemd_tmpfiles_t:s0 tcontext=system_u:object_r:proc_security_t:s0 tclass=file permissive=0 Jan 14 21:13:28 fedora audit[844]: SYSCALL arch=c000003e syscall=257 success=no exit=-13 a0=ffffffffffffff9c a1=7ffed3773b70 a2=80100 a3=0 items=0 ppid=1 pid=844 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-tmpfile" exe="/usr/bin/systemd-tmpfiles" subj=system_u:system_r:systemd_tmpfiles_t:s0 key=(null) Jan 14 21:13:28 fedora audit: PROCTITLE proctitle=73797374656D642D746D7066696C6573002D2D637265617465002D2D72656D6F7665002D2D626F6F74002D2D6578636C7564652D7072656669783D2F646576 Jan 14 21:13:28 fedora audit[844]: AVC avc: denied { read } for pid=844 comm="systemd-tmpfile" name="protected_hardlinks" dev="proc" ino=6327 scontext=system_u:system_r:systemd_tmpfiles_t:s0 tcontext=system_u:object_r:proc_security_t:s0 tclass=file permissive=0 Jan 14 21:13:28 fedora audit[844]: SYSCALL arch=c000003e syscall=257 success=no exit=-13 a0=ffffffffffffff9c a1=7ffed3773b70 a2=80100 a3=0 items=0 ppid=1 pid=844 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-tmpfile" exe="/usr/bin/systemd-tmpfiles" subj=system_u:system_r:systemd_tmpfiles_t:s0 key=(null) ``` (the entire raw journal text file is 13M in total)