Throw an error when esbuild loads a file outside the bazel sandbox.

[gonzojive]

This implementation uses an OnLoad plugin to catch when a file is loaded that is not in an allowlist of files. The allowlist is all the files within the BAZEL_BINDIR and all of the symlink targets of those files.

This may not prevent all sandbox escaping modes. The esbuild Go code may still access unsandboxed files in the course of loading files that are in the sanbox.

Addresses https://github.com/aspect-build/rules_esbuild/issues/58 and requires https://github.com/aspect-build/rules_js/pull/793 to work properly.

---

This PR is based on https://github.com/aspect-build/rules_esbuild/pull/32, but I lost the attribution in the commit log.

[CLAassistant]

All committers have signed the CLA.

[alexeagle]

@gregmagolan what are the next steps with this one?

[gonzojive]

ping?