Better sandbox USB access

[v1993]

Flatpak recently added the --device=usb finish arg and the USB portal. Both are still in beta as of now.

• The former is still somewhat fresh and will have no effect on earlier Flatpak versions, effectively breaking compatibility. It can replace the existing --device=all without any need for further changes, but has slightly worse sandboxing compared to using the USB portal.
• The latter is as of writing this not even in arch repos, so very very fresh, but it allows to be limited to access only the nintendo switch running nxdumptool. Note that it'll require coding in support for it (and it's not even a part of libportal as of now), but it would allow to do optimal sandboxing and also drop the network permission for hotplug (as it'll be handled by the desktop portal).

Sadly, I don't think either will allow me to drop manually installing udev rules, but still, better sandboxing is nice.