Sandboxed application can't communicate with browser extension

It's part of the security. We found that setuid was the only way that we could store encryption keys for communication in a root-owned keyring in the kernel, and that setgid was the best and most universal way of foiling LD_PRELOAD and other such potential library attacks on the communication helpers.

In any case, this is helpful information. It may be that there are some manual steps that will be needed, but first I'll be adjusting the entrypoint for the flatpak. And also telling 1Password what command to run to launch the helpers when we detect that we're running inside of a flatpak.