less "potentially unsafe" configuration

Flathub currently has a "Pulsar is potentially unsafe" advisory on the package. I used Flatseal to tinker a bit with the permissions and have had some success.

## Full system read/write access

I turned off "All filesystem files" and switched on the `host-os` option (All filesystem libraries, executables, and static data). Seems to be working so far with this configuration. I haven't yet pushed it further to disabling that one too.

Electron successfully uses the proper portal interfaces to open files, so I can do things like File/Open Folder *without* giving the app full home directory access.

I added `persistent=.pulsar` and this seems to be sufficient to retain its configuration and plugins.

🗑️ **Trash doesn't work**. This one took quite a bit of digging. As far as I can tell, it's not a Pulsar problem or even an Electron problem: they seem to be using the right APIs and a message does go to the Trash portal. I strongly suspect it's https://github.com/flatpak/xdg-desktop-portal/pull/1571 — I might be able to find out next time I restart…

## Legacy windowing system

Adding `ELECTRON_OZONE_PLATFORM_HINT=auto` makes it work in Wayland, so I can turn off the `socket=x11` and replace it with `socket=wayland`. (Add `socket=fallback-x11` to support Wayland but still allow things to work on X11-only systems.)

Upstream is considering making Pulsar support Wayland by default in https://github.com/pulsar-edit/pulsar/issues/381 — hopefully this works since they've done the big Electron upgrade.

## Uses non-portal services

I'm less clear on what this refers to, but let's see…
* `org.freedesktop.Notifications=talk`: can drop this now, according to [flatpak docs](https://docs.flatpak.org/en/latest/electron.html#enable-native-wayland-support-by-default).
* `org.gtk.vfs.*=talk`: still recommended by [these docs](https://docs.flatpak.org/en/latest/sandbox-permissions.html#gvfs-access) but I'm confused about why, if filesystem access happens through the portal.
* `sockets=pulseaudio`: probably unnecessary unless people expect Pulsar to be a media player or telephony client.

That cuts out most of it. I'm guessing you want to leave ssh-auth in by default so things like git-over-ssh work.