Fix sandbox usage

Issues with Metadata Cleaner and mat2's sandbox in the latest GNOME Flatpak runtime lead me to investigate how mat2 is using its sandbox.

I found the following:

• mat2's --no-sandbox argument is working in reverse (meaning by default no sandbox is used, and passing --no-sandbox would actually use a sandbox)
• When a parser needs child parsers (in archives or FLAC), the sandbox option is not passed down

These commits should fix those issues.

approved this merge request

enabled an automatic merge when the pipeline for 7405955a succeeds

canceled the automatic merge

merged

/cc @georg Backport to Debian stable.

added debian label