Fix sandboxing hermetic tmp to take into account sandbox_base

[oquenchil]

The logic for sandboxing hermetic tmp needs to take into account all paths under /tmp used during the build. A user may also pass a sandbox_base under /tmp even when the output_base is not. This change adds sandbox_base to the list.

Fix suggested by @fmeum

[fmeum]

@bazel-io fork 7.2.0