ebuild-writing/functions: Don't allow network access

There have been a number of bugs filed to remove network access from
ebuild phases [1,2,...], but until now this policy was undocumented
here.  We'll have to relax this restriction if the src_fetch [3,4,5] or
pkg_fetch [6] proposals being discussed for EAPI-6 are accepted, but
neither is currently mentioned in either the PMS [7] or Portage [8].

Portage *does* have a network-sandbox feature [9,10], which applies to
all src_* phases except src_unpack (for live ebuilds).  I think it
should be applied to pkg_* phases too, but Michał thinks they may need
networking "for some kind of IPC" [11].  Alexis pointed out that a
strict network-sandbox will break distcc [12], but since that network
access is the result of enabling a Portage feature (and not initiated
by the ebuild or package itself), it falls outside the scope of this
policy.

[1]: https://bugs.gentoo.org/show_bug.cgi?id=315403
     Summary: media-video/jubler fails to build without network
[2]: https://bugs.gentoo.org/show_bug.cgi?id=336771
     Summary: dev-libs/libevent tests require network access
[3]: https://bugs.gentoo.org/show_bug.cgi?id=182028
     Summary: [Future EAPI] About managing CVS/SUBVERSION version of
       software
[4]: http://thread.gmane.org/gmane.linux.gentoo.devel/47645/focus=52918
     From: Marijn Schouten <hkBst@gentoo.org>
     Subject: src_fetch (was Re: EAPI 1 (Was: Re: Monthly Gentoo
       Council Reminder for April))
     Date: 2007-11-09 17:41:38 GMT
[5]: http://thread.gmane.org/gmane.linux.gentoo.devel/87869
     From: Michał Górny <mgorny@gentoo.org>
     Subject: [EAPI 6] src_fetch() for fetching live sources
     Date: 2013-08-27 10:01:27 GMT
[6]: http://thread.gmane.org/gmane.linux.gentoo.devel/87869/focus=878773
     From: Ian Stakenvicius <axs@gentoo.org>
     Subject: Re: [EAPI 6] src_fetch() for fetching live sources
     Date: 2013-08-27 14:33:27 GMT
[7]: git://git.overlays.gentoo.org/proj/pms.git
[8]: git://git.overlays.gentoo.org/proj/portage.git
[9]: http://thread.gmane.org/gmane.linux.gentoo.devel/87641
     From: Michał Górny <mgorny@gentoo.org>
     Subject: New developer features in portage: cgroup,
       network-sandbox, ipc-sandbox
     Date: 2013-08-20 10:26:03 GMT
[10]: http://thread.gmane.org/gmane.linux.gentoo.devel/91131
      From: Michał Górny <mgorny@gentoo.org>
      Subject: RFC: enabling ipc-sandbox & network-sandbox by default
      Date: 2014-05-11 21:42:38 GMT
[11]: http://article.gmane.org/gmane.linux.gentoo.devel/87641
      From: Michał Górny <mgorny@gentoo.org>
      Subject: New developer features in portage: cgroup,
        network-sandbox, ipc-sandbox
      Date: 2013-08-20 10:26:03 GMT
[12]: http://thread.gmane.org/gmane.linux.gentoo.devel/87641/focus=87658
      From: Alexis Ballier <aballier@gentoo.org>
      Subject: Re: New developer features in portage: cgroup,
        network-sandbox, ipc-sandbox
      Date: 2013-08-20 15:04:35 GMT
Merge pull request #21 from wking/no-network-access

ebuild-writing/functions: Don't allow network access