Sandbox environment variables

So that the build can't access extra information unintentionally.
Particuarly ANDROID_BUILD_TOP is dangerous.

In the future PATH should be locked down as well.

Bug: 307824623
Test: Added a all_genrules target and built that
Change-Id: I88bb0efb0a82529a1c85875a53cf20c8384d07fe