[Sandbox] Allow reads on `/`.

This is required by `xcodebuild` when it builds a resource bundle
target. I have no idea why it needs to do that...
[Sandbox] Use a few more literal paths instead of regexps.