sandbox: sandbox all taps by default.
We've been doing this in `brew test-bot`, for our CI and for homebrew/core long enough that this is a reasonable default that provides more protection to our users of non-homebrew/core taps.
mktmpdir