hekad/common: add sandbox_hmac_key