Add FEATURES=ipc-sandbox to isolate IPC from host.

This way, only privileged phases (pkg_*) can use *nix IPC to communicate
with host applications. src_* use private IPC namespace.