Allow setting environment variables in local actions that don't affect the cache key

### Description of the feature request:

Sometimes, local actions need information that doesn't affect what they do. For example:
1. Address of a jobserver so that the local machine is not overloaded
2. Address of an RBE server of ccache if a complicated build is hidden behind a local action
3. Address of servers the action should connect to

etc.

This information should not be propagated to remotely executed actions and should not be part of the cache key (either in the local action cache, in the disk cache or in the remote cache), but Bazel currently does not offer such a facility.

This information is also not knowable by people writing BUILD/.bzl files, so it should be gathered from the command line. The closest we have is `--action_env`, but that one does affect the caches and propagates to RBE, so it doesn't quite do.

The easiest thing would be to add a `--sandbox_env` command line option that only applies to sandboxed actions.

The current best workaround is to put this information in a non-hermetic file. That requires adding a little wrapper around the action, though, to read it.

### Which category does this issue belong to?

_No response_

### What underlying problem are you trying to solve with this feature?

_No response_

### Which operating system are you running Bazel on?

_No response_

### What is the output of `bazel info release`?

_No response_

### If `bazel info release` returns `development version` or `(@non-git)`, tell us how you built Bazel.

_No response_

### What's the output of `git remote get-url origin; git rev-parse master; git rev-parse HEAD` ?

_No response_

### Have you found anything relevant by searching the web?

_No response_

### Any other information, logs, or outputs that you want to share?

_No response_

Start by tracing Bazel's command-line handling for --action_env and how sandboxed local actions receive environment variables. Define the expected behavior for a --sandbox_env option: values should apply only to sandboxed local actions and be excluded from local, disk, and remote cache keys and remote execution. The issue names no files or tests.

Written by the indexing model from the issue text.