Impossible to distinguish sandboxing errors from build errors

When building, or when running bst shell, it is impossible for BuildStream to distinguish and coherently report whether:

• there was an error with the actual build or command run in the shell
• there was an error setting up the sandbox

This requires support from bubblewrap, I've filed an issue upstream which seems relatively easy to fix, I like the approach Colin suggests by using the --info-fd option and extending the out-of-band machine readable data which bwrap can already return.

We should upstream a patch for this and then conditionally start using the feature in BuildStream on sites which have a recent enough version of bwrap.