Add sandboxing for build scripts

[0xdefoliate]

Currently, the scripts are run with the same privileges as the user.
We could use macOS' built-in Seatbelt sandbox for mitigating risks of potentially poisoned build scripts as a safe-guard.