[clang] [llvm] [llvm][clang] Sandbox filesystem reads (PR #165350)

[Ben Langmuir via llvm-commits]

https://github.com/benlangmuir approved this pull request.

LGTM other than changing the default value of `LLVM_ENABLE_IO_SANDBOX`.

https://github.com/llvm/llvm-project/pull/165350