linux-sandbox: apply fixups to deal with upstream sandboxing changes

TODO(rrbutani, rebase): like the test attr runfiles changes, our
sandboxing changes have have started to become (more) unwieldy — in part
because of recent upstream changes in this area:
  - bf6ebe9
  - bc1d9d3
  - fb6658c
    + this was our own fault, kind of...
  - 620d617
  - 5e68afd
  - 3748084

What's committed is definitely a series of hacks to get us unblocked for
now. Long-term we definitely want to rewrite these changes and look into
using the InputMetadata-based methods for detecting symlinks that some
of the above commits use.

Lots of TODOs within, lots that we don't understand...