Use the Philipp Wollermann approved way to require the sandbox.

This should let us drop another patch soon.

https://stackoverflow.com/questions/47173770/how-do-i-require-the-sandbox/47411085#47411085

Change-Id: Ibccaf9e9689cba058ed512c0685c09ac123c3304
diff --git a/tools/bazel.rc b/tools/bazel.rc
index 513bc94..8fb26ae 100644
--- a/tools/bazel.rc
+++ b/tools/bazel.rc
@@ -62,3 +62,4 @@
 startup --host_jvm_args=-Dbazel.DigestFunction=SHA1
 
 common --watchfs
+build --spawn_strategy=linux-sandbox