ci: install bubblewrap for the extension sandbox tests

[ZhuchkaTriplesix]

Why

e2e_extension_sandbox_security_test.dart checks that code inside bubblewrap cannot write to the host. It skips when bwrap is not usable, and CI never installed it, so the check never ran.

Change

• bubblewrap is installed in the test job next to libsecret-1-dev.

Not verified locally

Tests were not run locally, per the project rule. Two outcomes are possible in CI:

• The test runs and passes: the sandbox check is now active.
• The test runs and fails: the sandbox lets a write through, or the runner blocks user namespaces. That is a finding to act on, not a reason to skip the test again.