Ralph two-mechanism sandbox + security-review hardening#3

shuveb merged 2 commits into

mainZipstack/mfbt-cli:mainfrom

sandboxZipstack/mfbt-cli:sandboxCopy head branch name to clipboard