Add FEATURES=network-sandbox support, bug #481450

This way, only privileged phases (pkg_* and src_unpack) have network
access during the ebuild run. All of the src_* phases are completely
detached from host's network interfaces.
_exec: close socket
archive-conf: fix for python3, bug #481518
Add FEATURES=ipc-sandbox to isolate IPC from host.

This way, only privileged phases (pkg_*) can use *nix IPC to communicate
with host applications. src_* use private IPC namespace.