xpra-based display forwarding

Mounting /tmp/.X11-unix is icky because X11 security sucks; the containerized application has full access to the display and input devices. It could possibly set itself up as a keylogger.

[Xpra](https://www.xpra.org/) would be a more secure alternative to forward windows back to the host.

This will require a few changes:
- Host check that xpra is installed
- Installation of xpra in the container would be nice to automate.
- Launch script will need to start the application in xpra, and attach from the host over a determined TCP port. Does not need to be encrypted over lxcbrX.

This could be a really nice feature for running a full desktop environment, actually.