Fixing the brave sandbox

I looked through the log again, AFAICT the snap is trying to do things that seem to be allowed by browser-support provided allow-sandbox is enabled.

Chromium declares this in their snap:

plugs:
  browser-sandbox:
    allow-sandbox: true
    interface: browser-support

Back to the logs, this may be a problem:

audit[19388]: AVC apparmor="ALLOWED" operation="mknod" profile="snap.brave.brave" name="/dev/shm/shmfd-KP149M" pid=19388 comm="brave" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000
audit[19388]: AVC apparmor="ALLOWED" operation="open" profile="snap.brave.brave" name="/dev/shm/shmfd-KP149M" pid=19388 comm="brave" requested_mask="wrc" denied_mask="wrc" fsuid=1000 ouid=1000
audit[19388]: AVC apparmor="ALLOWED" operation="unlink" profile="snap.brave.brave" name="/dev/shm/shmfd-KP149M" pid=19388 comm="brave" requested_mask="d" denied_mask="d" fsuid=1000 ouid=1000
audit[19373]: AVC apparmor="ALLOWED" operation="truncate" profile="snap.brave.brave" name="/dev/shm/shmfd-KP149M" pid=19373 comm="brave" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000

The browser-support interface does not allow this. @jdstrand is probably best person to suggest something there.