feat: add homebrew-sandbox subpackage

[HastD]

This subpackage sets up brew to be sandboxed using the Landlock LSM, restricting its filesystem and network access.

Note, this change by itself won't enable the sandbox on secureblue images; that won't happen until we start installing homebrew-sandbox on the images. The only impact this will have on secureblue without further action is to change the directory that Homebrew uses for temporary files to /var/tmp/homebrew (instead of the default /var/tmp).

Also, the landlock crate used by the sandbox currently isn't packaged for Fedora, so it will need to be added to the Copr repo for this to build. This is easy to do—the following custom build script will generate its spec file:

#!/bin/sh
rust2rpm landlock