app: filter /tmp from permissive default

Tmpdir is bind mounted over further along in execution so there is no point sharing it here.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>

internal/app/seal.go

@@ -134,6 +134,7 @@ func (a *app) Seal(config *Config) error {
 				case "proc":
 				case "dev":
 				case "run":
+				case "tmp":
 				case "mnt":
 				default:
 					p := "/" + name