Add functionality to sandbox mixed build actions

The use case for this is for building rules_go's root builder which runs
into issues when built in a directory that contains a symlink to
prebuilts/go

The implementation will involve two changes of working dir
- `sbox` to change the working directory to
__SBOX_SANDBOX_DIR__
- the generated manifest will change the working
directory to mixed build execution root relative to that

Implemenation details
1. Create a unique intermediate path by hashing the outputs of a buildAction.
   "out/bazel/output/execroot/__main__/" was deliberately not chosen as
   the outpuDir for the sandbox because ruleBuilder would wipe it.
   `sbox` will generate the files in __SBOX_SANDBOX_DIR__ and then place
   the files in this intermediate directory.
2. After the files have been generated in (1), copy them to
   out/bazel/output/execroot/__main__/...
3. For bazel depsets that are inputs of an action, copy the direct
   artifacts into the sandbox instead of the phony target
4. Make sandboxing an opt-in. Currently we will only use it for
   `GoToolchainBinaryBuild`

In the current implementation, (3) will increase the size of the ninja
file. With sboxing turned on for only GoToolchainBinaryBuild, this will
increase the size of the ninja file by around 1.3% on aosp's cf

Test: m com.android.neuralnetworks (will build soong_zip from source
using rules_go)
Test: OUT_DIR=out.other m com.android.neuralnetworks
Bug: 289102849

Change-Id: I7addda9af583ba0ff306e50c1dfa16ed16c29799