Port bug 1041886 - Separate Linux sandbox code into its own shared library. rs=port-by-build-system-peer. bustage fix for CLOSED TREE