Sandbox nos genrules

go/roboleaf-busy-beavers-sandboxing

Bug: 307824623
Test: m nos_app_avb_service_genc++ nos_app_avb_service_genc++_headers nos_app_avb_service_genc++_mock nos_app_identity_service_genc++ nos_app_identity_service_genc++_headers nos_app_identity_service_genc++_mock nos_app_keymaster_service_genc++ nos_app_keymaster_service_genc++_headers nos_app_keymaster_service_genc++_mock nos_app_weaver_service_genc++ nos_app_weaver_service_genc++_headers nos_app_weaver_service_genc++_mock nos_generator_test_service_genc++ nos_generator_test_service_genc++_headers nos_generator_test_service_genc++_mock
Change-Id: Ic2c6ff1bbc0037c59b692fd76c9050521812989e