bug#45198: 28.0.50; Sandbox mode

[Mattias Engdegård]

> I'm still worried that there remain wide open security holes, tho.

Yes, and we need defence in depth. In addition to the measures already taken in 
the patch:

1. Add crash_if_sandboxed() calls in low-level routines that do objectionable 
things such as opening files for writing, create network connections, spawn 
processes, do DNS lookups, etc.

2. Platform-specific restrictions. I'll add macOS sandboxing if nobody else 
does. For Linux there are several options, most a bit messy but possible to 
use: seccomp (with or without BFP), name spaces, ptrace, etc.