"Compatibility level" like debhelper?

Several `bwrap` options have semantics and defaults that, with hindsight, are perhaps not what we would have wanted.

One way to improve on this might be to borrow an idea from Debian's debhelper, and have an argument to set the "compat level". The default if not specified would be compat level 0.

In newer compat levels, we could change the defaults to make more sense, even in ways that would be a compatibility break, because they won't affect callers that haven't opted in to the new behaviour. For example:

* `bwrap --compat 1 --file 23 /foo` could create `/foo` with default permissions 0644 instead of 0666
* `bwrap --compat 1 --seccomp 23 --seccomp 42` (see #453) could be a fatal error, instead of just giving a warning