Consider blacklisting `setuid` binaries

[madsmtm]

We currently allow read+execute access to all binaries in $PATH to make things actually usable, but there might be security issues with allowing executing setuid binaries like sudo?

Will need to look into that, if it's a problem then a possible solution could be to iterate over all binaries in $PATH, and if the binary is a setuid binary, blacklist it? Though we'd have to make sure that the path iteration is the same as whatever is done in the sandbox itself, so maybe it'd be better to explicitly whitelist each non-setuid binary?

[madsmtm]

Another problem is that some system / Xcode binaries are signed with entitlements that give them further permissions. The classic example is lldb. We might want to restrict access to that as well?