Add a basic sandbox tool to launch a command which can only access a
list of file hierarchies in a read-only or read-write way.

Cc: James Morris
Cc: Serge E. Hallyn
Signed-off-by: Mickaël Salaün
Reviewed-by: Jann Horn
Reviewed-by: Kees Cook
Link: https://lore.kernel.org/r/20210422154123.13086-12-mic@digikod.net
Signed-off-by: James Morris