Preserve TMPDIR for sandbox chroot setup

[Haihan-Jiang]

Fixes #12476.

The sandbox process clears its environment before running boot. That keeps the sandbox process from inheriting arbitrary caller environment variables, but it also drops TMPDIR, so os.TempDir() in the sandbox can resolve to /tmp even when the parent runsc process was launched with a different host temp directory such as /realtmp. The chroot setup then attempts to mount using the wrong path and can fail on systems where /tmp must not be used or is a symlink.

This change:

• centralizes sandbox process environment construction;
• keeps the existing default of clearing the sandbox environment;
• preserves only TMPDIR when the parent process has it set;
• keeps TEMP, TMP, and other caller variables out of the sandbox environment;
• updates the root environment test allowlist for the intentional TMPDIR exception.

Validation:

• gofmt -w runsc/sandbox/sandbox.go runsc/sandbox/env_test.go test/root/runsc_test.go
• git diff --check
• bazel build --nobuild //runsc/sandbox:sandbox_test //test/root:root_test

I also attempted bazel test //runsc/sandbox:sandbox_test on macOS, but this host cannot build the existing eBPF genrules because Linux headers such as linux/types.h are unavailable.