We'll soon have to store more than just the GVariant, so in
preparation for that, store the variant in a custom struct,
and proxy that variant when retrieving the transient permission.

This is really old and available in Ubuntu 18.04 (!) so since we're
going to start using functions from that version, might as well
declare that in the build system.

This should never normally trigger, but seems like a good warning
to have. We can't print the permission id, as that could leak the
token in the journal log.

This comes after a recent discussion. Transient permissions are
modeled mainly towards browsers who have to do IPC and cannot
share the PipeWire node directly. Instead, they can request a
transient permission that allows restoring the stream that one
process requested, but without granting the browser "eternal"
access to that stream subsequently.

However, an oversight of the original implementation was the
case where we grant the permission, but the app stays open for
very long times, which is fairly common when it comes to browsers.

Expire transient permission tokens after 24 hours have passed.

Closes flatpak#981