refactor(backend): extract sandbox logic into windmill-sandbox crate

Move nsjail config, overlayfs, tar utilities, S3 operations, and sandbox
types from windmill-common and windmill-worker into a dedicated
windmill-sandbox crate. S3 logic lives in windmill-ee-private (symlinked
s3_ee.rs). Both windmill-api and windmill-worker depend on the new crate.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/windmill-worker/src/java_executor.rs

@@ -598,7 +598,7 @@ async fn run<'a>(
         )
         .await;
 
-        let nsjail_config = crate::sandbox_setup::finalize_nsjail_config(
+        let nsjail_config = windmill_sandbox::finalize_nsjail_config(
             &NSJAIL_CONFIG_RUN_JAVA_CONTENT
                 .replace("{JOB_DIR}", job_dir)
                 .replace("{CACHE_DIR}", JAVA_CACHE_DIR)