add a trivial test of the sandbox functionality

Note, this probably breaks for DragonFly and NetBSD that don't have sandboxing
options. We should disable this test for them before the next release.