block-network allows tcp access to unsandboxed localhost servers in darwin-sandbox, but not in linux-sandbox

### Description of the problem / feature request:

There is a divergence between Linux and macOS network sandboxing, in regards to accessing localhost. This was discovered last year by tests committed in https://github.com/bazelbuild/bazel/commit/8645090197b15a158cc5fed4de205d9e46a2af57.

https://github.com/bazelbuild/bazel/blob/dcead939ba5fe39d61da6a18a6f83d75e1117f46/src/test/shell/bazel/bazel_sandboxing_test.sh#L474-L494

### Feature requests: what underlying problem are you trying to solve with this feature?

I have hermetic test which is starting its own server process and then connects to it, all on a single machine, using localhost. I want this test to run on Linux and macOS, regardless of what other processes may be listening on the same port outside of the sandbox.

Currently, on Linux all works the way I want. On macOS, however, the processes inside of sandbox are unable to open a listening socket on a port where something already listens outside of the sandbox.

### Bugs: what's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

Download a tar.gz with a reproducer Bazel project. https://github.com/bazelbuild/bazel/commit/8645090197b15a158cc5fed4de205d9e46a2af57#commitcomment-39005563

### What operating system are you running Bazel on?

NixOS 20.03 and macOS Mojave

### What's the output of `bazel info release`?

release 3.1.0

### Have you found anything relevant by searching the web?

> Replace these lines with your answer.

* https://github.com/bazelbuild/bazel/issues/10068
* https://groups.google.com/forum/#!topic/bazel-dev/PDhzYQd6umE
* https://github.com/bazelbuild/bazel/issues/5206
* https://github.com/bazelbuild/bazel/pull/3444, looks like the macOS behavior is intentional, "We do allow networking with non-virtualized localhost though."

* https://github.com/bazelbuild/bazel/issues/5869

### Any other information, logs, or outputs that you want to share?

The reproducer project building on macOS.

```
# this is with ./start_me_first.sh running

$ bazel test //:all --cache_test_results=no --test_output=streamed --spawn_strategy=darwin-sandbox
WARNING: Streamed test output requested. All tests will be run locally, without sharding, one at a time
INFO: Analyzed 2 targets (0 packages loaded, 0 targets configured).
INFO: Found 2 test targets...
+ curl http://localhost:8901/file.txt
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 9 100 9 0 0 1285 0 --:--:-- --:--:-- --:--:-- 1285
outside
+ exit 1
FAIL: //:connect_8901_outside_should_fail (see /private/var/tmp/_bazel_cloud-user/e373d86e469780d831c8413f2f91c1bf/execroot/__main__/bazel-out/darwin-fastbuild/testlogs/connect_8901_outside_should_fail/test.log)
+ echo inside
+ pid=1217
+ sleep 1
+ python3 -mhttp.server 8902
Traceback (most recent call last):
File "/opt/local/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/runpy.py", line 193, in _run_module_as_main
"__main__", mod_spec)
File "/opt/local/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/runpy.py", line 85, in _run_code
exec(code, run_globals)
File "/opt/local/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/http/server.py", line 1262, in
test(HandlerClass=handler_class, port=args.port, bind=args.bind)
File "/opt/local/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/http/server.py", line 1230, in test
with ServerClass(server_address, HandlerClass) as httpd:
File "/opt/local/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/socketserver.py", line 452, in __init__
self.server_bind()
File "/opt/local/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/http/server.py", line 137, in server_bind
socketserver.TCPServer.server_bind(self)
File "/opt/local/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/socketserver.py", line 466, in server_bind
self.socket.bind(self.server_address)
OSError: [Errno 48] Address already in use
+ ps -p 1217
/private/var/tmp/_bazel_cloud-user/e373d86e469780d831c8413f2f91c1bf/sandbox/darwin-sandbox/23/execroot/__main__/bazel-out/darwin-fastbuild/bin/listen_8902_inside_should_succeed.runfiles/__main__/listen_8902_inside_should_succeed: line 8: /bin/ps: Operation not permitted
+ exit 1
FAIL: //:listen_8902_inside_should_succeed (see /private/var/tmp/_bazel_cloud-user/e373d86e469780d831c8413f2f91c1bf/execroot/__main__/bazel-out/darwin-fastbuild/testlogs/listen_8902_inside_should_succeed/test.log)
INFO: Elapsed time: 1.714s, Critical Path: 1.22s
INFO: 4 processes: 4 darwin-sandbox.
INFO: Build completed, 2 tests FAILED, 3 total actions
//:connect_8901_outside_should_fail FAILED in 0.1s
/private/var/tmp/_bazel_cloud-user/e373d86e469780d831c8413f2f91c1bf/execroot/__main__/bazel-out/darwin-fastbuild/testlogs/connect_8901_outside_should_fail/test.log
//:listen_8902_inside_should_succeed FAILED in 1.1s
/private/var/tmp/_bazel_cloud-user/e373d86e469780d831c8413f2f91c1bf/execroot/__main__/bazel-out/darwin-fastbuild/testlogs/listen_8902_inside_should_succeed/test.log

INFO: Build completed, 2 tests FAILED, 3 total actions
```

Start with src/test/shell/bazel/bazel_sandboxing_test.sh lines 474-494 and reproduce with the supplied localhost server setup using --spawn_strategy=darwin-sandbox. Compare the existing Linux and macOS sandbox behavior; done means the relevant localhost TCP tests pass consistently on both platforms without permitting unrelated external access.

Written by the indexing model from the issue text.