CLSA-2026-1777541348 flatpak: Fix of CVE-2021-43860

CVE-2021-43860: hidden permissions via null byte in metadata file...