Move sandboxing code to buildbox-run-bubblewrap

Bubblewrap sandboxing should be kept independent of FUSE. See also buildbox-worker#5 (closed)

This depends on buildbox-casd#8 (closed) to make it possible for buildbox-run-bubblewrap to use buildbox-fuse (via buildbox-casd).