Add OPAM2 sandboxing wrappers and update Ubuntu/Fedora

• Add OCaml 4.04.1 to the stable released set.
• Add Ubuntu 17.04 and Fedora 25 to the distribution list.
• Setup OPAM2 wrappers in containers. This will enforce Linux
  namespaces upon building and installing the packages, preventing
  them from doing network access when they shouldn't or writing files
  where they shouldn't (#1 from @AltGr). These are not activated
  by default and are present in /etc/opamrc.userns in the relevant
  OPAM2 containers.