profiles: mov-cli: remove ffmpeg & allow more paths (#6304)

Changes:

* Remove ffmpeg from private-bin
* Allow download folder
* It needs an editor to allow editing the config, so I put in nano; sh
  and uname are used for launching nano

Co-authored-by: exponential <echo ZXhwb25lbnRpYWxtYXRyaXhAcHJvdG9ubWFpbC5jb20K | base64 -d>

etc/profile-m-z/mov-cli.profile

@@ -10,11 +10,16 @@ include mov-cli.local
 
 noblacklist ${HOME}/.config/mov-cli
 
+# Allow /bin/sh (blacklisted by disable-shell.inc)
+include allow-bin-sh.inc
+
 include disable-proc.inc
 include disable-xdg.inc
 
 mkdir ${HOME}/.config/mov-cli
 whitelist ${HOME}/.config/mov-cli
+whitelist ${DOWNLOADS}
+whitelist /usr/share/nano
 include whitelist-run-common.inc
 include whitelist-runuser-common.inc
 
@@ -24,9 +29,9 @@ noprinters
 notv
 
 disable-mnt
-private-bin ffmpeg,fzf,mov-cli
+private-bin fzf,mov-cli,nano,sh,uname
 #private-cache
-private-etc X11,alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,group,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,magic,magic.mgc,mime.types,nsswitch.conf,pango,passwd,pki,protocols,pulse,resolv.conf,rpc,services,ssl,xdg
+private-etc X11,alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,group,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,magic,magic.mgc,mime.types,nanorc,nsswitch.conf,pango,passwd,pki,protocols,pulse,resolv.conf,rpc,services,ssl,xdg
 private-tmp
 
 # Redirect