sandbox: add feature to disallow reads outside of workspace and ~/.codex/ to mitigate `lethal trifecta` risks

What feature would you like to see?

The sandbox currently lacks a way to disallow reads outside of workspace + ~/.codex/ (or is not documented). This makes usage of codex for internet facing tasks such as deploying it as a deep research agent unsuitable due to the lethal trifecta risks. Currently, the only way to mitigate is via a container sandbox, which adds complexity. codex cli should have this functionality baked in or provide documentation for users on how to do it safely via a container.

codex cli version: 0.77.

Additional information

_No response_