bst shell: Added --isolate option, disabled by default.

This changes a few things:

  o How the shell environment and sandbox modes are setup is
    not decided by whether a `--build` sandbox was staged or not

  o In interactive build debugging mode, an isolated build
    sandbox is used

  o The bst shell command now has the option to control it

  o All invocations of bst shell now use a read-only rootfs,
    avoiding FUSE layer and file descriptor limits (this can
    be made optional later if needed)

This is a part of issue #223