sandbox: only allow local network operations

[nandahkrishna]

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same change?
• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your changes? Here's an example.
• Have you successfully run brew style with your changes locally?
• Have you successfully run brew typecheck with your changes locally?
• Have you successfully run brew tests with your changes locally?

---

This PR is an attempt to restrict network operations in the sandbox (for build, postinstall and test) to just local network operations. The sandbox rules were inspired from: https://github.com/bazelbuild/bazel/blob/4d62c8f7557a4673ffe5600f963fdfddd7b99d3b/src/main/java/com/google/devtools/build/lib/sandbox/DarwinSandboxedSpawnRunner.java#L300-L302

This might have to be modified a bit and may cause problems with a bunch of formulae too, so further testing will be required. CC @woodruffw.

[Bo98]

This will definitely break a lot, including all formulae that uses a language package manager (npm, cargo, etc.) as we don't use resources for those with sufficient lockfiles.

[nandahkrishna]

Based on a short discussion with Mike, we thought it might be good have a separate fetch block/phase which does have network access but restricted write permissions. This would just download all these dependencies to the cache and then the install phase would be able to use these. I'm going to spend some time to try and implement that if it makes sense.

[woodruffw]

Sorry, premature review -- sounds like there's still some stuff to be done here 🙂

[github-actions]

This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.