Add FEATURES=network-sandbox support, bug #481450

This way, only privileged phases (pkg_* and src_unpack) have network
access during the ebuild run. All of the src_* phases are completely
detached from host's network interfaces.