Hardlink sandbox for Mac OS

### Description of the feature request:

The hardlink sandbox, toggled via `experimental_use_hermetic_linux_sandbox`, is a step forward in ensuring the hemeticity of build actions and tests as tools are no longer able to "accidentally" follow symlinks out of the sandbox to pick up files outside of the source set specified. This also means tools don't have to be hacked, patched, or reconfigured in error-prone and unsound ways to respect Bazel's sandbox.

It would be great to extend this feature beyond Linux to MacOS. In our case, all our developers use Macs whereas our CI uses Linux. It is unfortunate that, due to the lack of hardlink sandbox on the former, the development environment behaves differently - in both subtle and significant ways - to the CI.

### Which category does this issue belong to?

_No response_

### What underlying problem are you trying to solve with this feature?

_No response_

### Which operating system are you running Bazel on?

_No response_

### What is the output of `bazel info release`?

_No response_

### If `bazel info release` returns `development version` or `(@non-git)`, tell us how you built Bazel.

_No response_

### What's the output of `git remote get-url origin; git rev-parse HEAD` ?

_No response_

### Have you found anything relevant by searching the web?

_No response_

### Any other information, logs, or outputs that you want to share?

_No response_