Host file read-write via symlinked persist directory

Sandbox escape in Flatpak before 1.14.10 and 1.15.0 through 1.15.9 allows local users to read and write host files via a malicious app. The persistent-directory mount path in flatpak_context_append_bwrap_filesystem follows a symlink placed at ~/.var/app/$APPID/subdir and bind-mounts its target inside the sandbox. Exploitation requires an installed malicious or compromised app with the persistent permission; the exposed target can then be read or modified with the local user's host privileges.