Build into a cabal sandbox.

This means that you can `make` a clean checkout without mucking with your global Haskell state. Also cabal update: you need Internet anyway in the build since cabal brings down a load of dependencies, so you might as well do the update as part of it.