bazel: disable sandboxing and avoid stamping

- Sandboxing on MacOS have measurable overhead. See
  bazelbuild/bazel#8230; it comes from
  symlinks being much slower to create. This commit disables sandboxing
  on local builds (still present in CI) to hopefully speed up builds.
  - If this proves to be buggy for whatever reason, we could opt out of
    sandboxing for go package compiles specifically using
    --strategy=GoCompilePkg=local.
  - In the future if we want local sandboxing, we could explore
    sandboxfs: https://bazel.build/docs/sandboxing
- When used with a remote build cache, these stamps (despite being marked
  as volatile), induce an unnecessary golink step when switching back
  and forth between branches. See bazelbuild/bazel#10075. Opting out
  here shaves a few precious seconds if the previously built binary is
  already available.

Release note: None

.bazelrc

@@ -74,6 +74,8 @@ build:devdarwinx86_64 --config=dev
 build:dev --stamp --workspace_status_command=./build/bazelutil/stamp.sh
 build:dev --action_env=PATH
 build:dev --host_action_env=PATH
+build:dev --spawn_strategy=local --strategy=Genrule=sandboxed
+build:dev --nostamp
 
 try-import %workspace%/.bazelrc.user