[codex-rs] More fine-grained sandbox flag support on Linux (#632)

##### What/Why
This PR makes it so that in Linux we actually respect the different
types of `--sandbox` flag, such that users can apply network and
filesystem restrictions in combination (currently the only supported
behavior), or just pick one or the other.

We should add similar support for OSX in a future PR.

##### Testing
From Linux devbox, updated tests to use more specific flags:
```
test linux::tests_linux::sandbox_blocks_ping ... ok
test linux::tests_linux::sandbox_blocks_getent ... ok
test linux::tests_linux::test_root_read ... ok
test linux::tests_linux::test_dev_null_write ... ok
test linux::tests_linux::sandbox_blocks_dev_tcp_redirection ... ok
test linux::tests_linux::sandbox_blocks_ssh ... ok
test linux::tests_linux::test_writable_root ... ok
test linux::tests_linux::sandbox_blocks_curl ... ok
test linux::tests_linux::sandbox_blocks_wget ... ok
test linux::tests_linux::sandbox_blocks_nc ... ok
test linux::tests_linux::test_root_write - should panic ... ok
```

##### Todo
- [ ] Add negative tests (e.g. confirm you can hit the network if you
configure filesystem only restrictions)

codex-rs/core/src/codex.rs

@@ -868,6 +868,7 @@ async fn handle_function_call(
                 sandbox_type,
                 &roots_snapshot,
                 sess.ctrl_c.clone(),
+                sess.sandbox_policy,
             )
             .await;
 
@@ -952,11 +953,14 @@ async fn handle_function_call(
 
                             let retry_roots = { sess.writable_roots.lock().unwrap().clone() };
 
+                            // This is an escalated retry; the policy will not be
+                            // examined and the sandbox has been set to `None`.
                             let retry_output_result = process_exec_tool_call(
                                 params.clone(),
                                 SandboxType::None,
                                 &retry_roots,
                                 sess.ctrl_c.clone(),
+                                sess.sandbox_policy,
                             )
                             .await;