pygrub: security-supported only when run de-privileged

XSA-443 and XSA-497 addressed specific issues in specific file system
drivers (libfsimage) used by pygrub. Further issues were reported, and yet
more are to be expected. XSA-443 introduced a means to run pygrub de-
privileged. Only this mode of operation is security supported from now on.

This is XSA-508.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Juergen Gross <jgross@suse.com>

SUPPORT.md

@@ -288,6 +288,12 @@ or itself will not be regarded a security issue.
     Status, untrusted driver domains: Supported, not security supported
     Status, Liveupdate: Not functional
 
+## Guest boot loaders
+
+### Pygrub
+
+    Status: Supported, security supported only when run de-privileged
+
 ## Toolstack/3rd party
 
 ### libvirt driver for xl