Removed "no-sandbox" execution requirements for (partial) remote execution support

[storypku]

We can pass .clang-tidy config around so that clang-tidy will always find it when running, thus removing the need for "no-sandbox" execution constraint.

[erenon]

How does this solution work? iirc, files in filegroups are placed into a location that matches their label, however, this location does not match the execution root, where clang tidy is running from, where clang tidy will look for the configuration. How does it find the config? How did you test it? thanks

[storypku]

As can be seen from the sreenshot above, when passing //.clang_tidy_config as input to ctx.actions.run, If we run bazel-clang-tidy with --sandbox_debug, the .clang-tidy file is found at some parent path.

[erenon]

Thanks!