Strengthen metalava sandbox support using sbox

Run sandbox metalava rules inside sbox, which copies only the expected
inputs into a separate directory tree.  This ensures it can't read any
extra inputs.

Test: m hwbinder.stubs
Test: TestDroidstubs
Test: TestDroidstubsSandboxed
Change-Id: I71a83e3af6a385cc23f895397c2c883a2ac5fa22