image: drop Bitwarden device access to dri

The manifest grants devices=all — webcam, microphone, raw USB. A password
manager needs the GPU and nothing else on that list.

Verified as a --user override first, per the rule the Discord incident earned:
Bitwarden launches and maps its window with this applied.

Author: mark-iid

SETUP.md

@@ -222,7 +222,8 @@ bluetooth audio, and suspend/resume. Only then wipe the internal drive (§9.10).
       automatically, but a machine that already has the override file keeps its
       old copy. Re-apply by hand after tightening any of them:
       ```
-      sudo flatpak override --system --nosocket=x11 com.bitwarden.desktop
+      sudo flatpak override --system --nosocket=x11 --nodevice=all --device=dri \
+        com.bitwarden.desktop
       sudo flatpak override --system --nofilesystem=home --filesystem=xdg-download \
         com.github.IsmaelMartinez.teams_for_linux
       sudo flatpak override --system --nodevice=all --device=dri --disallow=devel \

files/system/usr/share/factory/var/lib/flatpak/overrides/com.bitwarden.desktop

@@ -17,6 +17,10 @@
 # absent, and if Wayland is down under niri there is no desktop to run Bitwarden
 # in anyway.
 sockets=wayland;!x11;
+# devices=!all;dri — the manifest grants `all`: webcam, microphone, raw USB. A
+# password manager needs the GPU and nothing else on that list. Verified as a
+# --user override first: Bitwarden launches and maps its window with this applied.
+devices=!all;dri;
 
 [Environment]
 ELECTRON_OZONE_PLATFORM_HINT=auto