feat(linux-sandbox): vendor bubblewrap and wire it with FFI (#10413)

## Summary

Vendor Bubblewrap into the repo and add minimal build plumbing in
`codex-linux-sandbox` to compile/link it.

## Why

We want to move Linux sandboxing toward Bubblewrap, but in a safe
two-step rollout:
1) vendoring/build setup (this PR),  
2) runtime integration (follow-up PR).

## Included

- Add `codex-rs/vendor/bubblewrap` sources.
- Add build-time FFI path in `codex-rs/linux-sandbox`.
- Update `build.rs` rerun tracking for vendored files.
- Small vendored compile warning fix (`sockaddr_nl` full init).

follow up in https://github.com/openai/codex/pull/9938

codex-rs/vendor/bubblewrap/tests/use-as-subproject/meson.build

@@ -0,0 +1,20 @@
+project(
+  'use-bubblewrap-as-subproject',
+  'c',
+  version : '0',
+  meson_version : '>=0.49.0',
+)
+
+configure_file(
+  output : 'config.h',
+  input : 'dummy-config.h.in',
+  configuration : configuration_data(),
+)
+
+subproject(
+  'bubblewrap',
+  default_options : [
+    'install_rpath=${ORIGIN}/../lib',
+    'program_prefix=not-flatpak-',
+  ],
+)