Support RuleBuilder.Sbox to wrap commands in sbox

This essentially allows you to declare that everything in a directory
will be created by the rule, and we'll ensure that your command actually
writes out all of the claimed outputs, and remove any other files that
previously existed in that directory.

Bug: 144948629
Test: built-in tests
Change-Id: I990dce2b3a0d89ebd2736ac1a0cadfb5864c6e73
Merged-In: I990dce2b3a0d89ebd2736ac1a0cadfb5864c6e73
(cherry picked from commit 633c5022)