It doesn't quite work for redshift-gtk, but with these few modifications
it does. Existing users can delete the old profiles we shipped from
`/usr/local/etc/firejail/`.
I'm sure this is entirely unnecessary, but since I am now allowing
redshift to access my location via geoclue rather than hardcoding it in
the config file, I feel better about having it locked down.