Introduce mkosi-sandbox and stop using subuids for image builds

.gitignore

@@ -4,6 +4,7 @@
 .cache
 .mkosi.1
 .mkosi-initrd.1
+.mkosi-sandbox.1
 .mypy_cache/
 .project
 .pydevproject

action.yaml

@@ -66,7 +66,6 @@ runs:
         sudo apt-get update
         sudo apt-get install --assume-yes --no-install-recommends \
           archlinux-keyring \
-          bubblewrap \
           debian-archive-keyring \
           dnf \
           makepkg \

kernel-install/50-mkosi.install

@@ -12,11 +12,11 @@ from typing import Optional
 
 from mkosi import identify_cpu
 from mkosi.archive import make_cpio
-from mkosi.config import OutputFormat, __version__
+from mkosi.config import OutputFormat
 from mkosi.log import die, log_setup
 from mkosi.run import run, uncaught_exception_handler
+from mkosi.sandbox import __version__, umask
 from mkosi.types import PathString
-from mkosi.util import umask
 
 
 @dataclasses.dataclass(frozen=True)