Sandbox improvements

Unshare UTS (hostname) and IPC namespaces in build sandboxes for further isolation. I've used the existing SandboxFlags.NETWORK_ENABLED to control this as the hostname is network-related and the network namespace already covers other IPC methods (abstract Unix sockets).