modif: Stop forwarding own double-dash to the shell

[kmk3]

Currently, if double-dash ("--") is passed to firejail, it is forwarded
to the user shell:

$ firejail --debug --noprofile -- echo test 2>&1 |
  grep -e execvp -e test
Building quoted command line: 'echo' 'test'
Building quoted command line: 'echo' 'test'
Running 'echo' 'test'  command through /bin/bash
execvp argument 0: /bin/bash
execvp argument 1: -c
execvp argument 2: --
execvp argument 3: 'echo' 'test'
test

This causes issues when the user shell does not accept "--" / is not
POSIX-compatible:

$ /bin/bash -c -- 'echo test'
test
$ /bin/fish -c -- 'echo test'
fish: Unknown command: --
fish:
--
^

Fixes #5599.

Relates to #3434.

Reported-by: @iltep64
Reported-by: @ferreum

[glitsj16]

LGTM

[kmk3]

To expand on the rationale:

I think that firejail should either always or never pass -- to the shell,
regardless of whether -- was passed to firejail itself.

Always passing -- seems to be a bit "safer"; from sh(1p) of POSIX.1-2017:

SYNOPSIS
       sh [-abCefhimnuvx] [-o option]... [+abCefhimnuvx] [+o option]...
           [command_file [argument...]]

       sh -c [-abCefhimnuvx] [-o option]... [+abCefhimnuvx] [+o option]...
           command_string [command_name [argument...]]

       sh -s [-abCefhimnuvx] [-o option]... [+abCefhimnuvx] [+o option]...
           [argument...]

[...]

APPLICATION USAGE
       [...]

       A conforming application must protect its first operand, if it starts
       with a <plus-sign>, by preceding it with the "--" argument that denotes
       the end of the options.

Though that would break running shell commands directly (such as with firejail echo test) for every user that has fish as the default shell.

Also, it seems that the first operand is always -c when firejail calls the
shell in this manner, in which case the scenario from the man page would not
apply. Otherwise, for that to be an issue, it appears that all of the
following would have to happen:

• There exists a command that starts with + in some shell
• This shell is set as the default user shell
• The user tries to run something with this command as the first argument
  directly through firejail

Which seems rather unlikely.

So this PR does the opposite and changes firejail to never call the shell with
--.

[netblue30]

merged!