Run youtube-dl with reduced privileges

It seems like an unnecessarily wide security exposure to automatically download youtube-dl over https with no additional verification (i.e. cert pinning, additional hashes/signatures) and then running it as the full peertube user, rather than in a reduced privilege context. It only needs network and stdout, we could run it in a chroot environment an as a different user.

It wouldn't be hard to imagine a vulnerability in either youtube-dl itself or the update process, and right now peertube installations have no protection against this attack surface.

The issue names no files, tests, or entry points. Start by locating where youtube-dl is downloaded and executed, then define the privilege boundary and verify that the process retains only network and stdout access in a reduced context.

Written by the indexing model from the issue text.