feat(linux-sandbox): vendor bubblewrap and wire it with FFI (#10413)

## Summary

Vendor Bubblewrap into the repo and add minimal build plumbing in
`codex-linux-sandbox` to compile/link it.

## Why

We want to move Linux sandboxing toward Bubblewrap, but in a safe
two-step rollout:
1) vendoring/build setup (this PR),  
2) runtime integration (follow-up PR).

## Included

- Add `codex-rs/vendor/bubblewrap` sources.
- Add build-time FFI path in `codex-rs/linux-sandbox`.
- Update `build.rs` rerun tracking for vendored files.
- Small vendored compile warning fix (`sockaddr_nl` full init).

follow up in https://github.com/openai/codex/pull/9938

codex-rs/vendor/bubblewrap/completions/bash/meson.build

@@ -0,0 +1,35 @@
+bash_completion_dir = get_option('bash_completion_dir')
+
+if bash_completion_dir == ''
+  bash_completion = dependency(
+    'bash-completion',
+    version : '>=2.0',
+    required : false,
+  )
+
+  if bash_completion.found()
+    if meson.version().version_compare('>=0.51.0')
+      bash_completion_dir = bash_completion.get_variable(
+        default_value: '',
+        pkgconfig: 'completionsdir',
+        pkgconfig_define: [
+          'datadir', get_option('prefix') / get_option('datadir'),
+        ],
+      )
+    else
+      bash_completion_dir = bash_completion.get_pkgconfig_variable(
+        'completionsdir',
+        default: '',
+        define_variable: [
+          'datadir', get_option('prefix') / get_option('datadir'),
+        ],
+      )
+    endif
+  endif
+endif
+
+if bash_completion_dir == ''
+  bash_completion_dir = get_option('datadir') / 'bash-completion' / 'completions'
+endif
+
+install_data('bwrap', install_dir : bash_completion_dir)