nested user namespaces are not enabled on the other runners.

Otherwise, with pylint3 2.2.2-1 on current Debian sid:

  libmat2/abstract.py:40:8: W0107: Unnecessary pass statement (unnecessary-pass)

subprocess.run wrapper: require an input filename and adjust type annotation to clarify that the output filename is optional.

This code is exercised either by tests:debian or by
tests:debian_with_bubblewrap, not both. So in each case the other,
unexercised branch would trigger a lack of coverage error.

This gives us a single location to implement #90.

This will make it easier to implement #90: we'll have one single API entry point
to wrap.

And incidentally, this ports the code from the "Older high-level API" to the
currently recommended one: as per
https://docs.python.org/3/library/subprocess.html, "the recommended approach to
invoking subprocesses is to use the run() function for all use cases it can
handle".

This should solve collisions with people like me that
are copy/pasting the documentation, creating conflicts
with other extensions that are doing the very same thing.

Kudos to Sherry Taylor for reporting this issue