sandbox/_sandboxbwrap.py: Use --die-with-parent

This ensures subprocesses are cleaned up when the bwrap parent dies.

This is available since bubblewrap 0.1.8. We skip the option if the host
bwrap does not support it.