Linux sandboxes do not isolate "abstract" UNIX domain sockets (IPC)

### Description of the bug:

I'm using a compiler which uses UNIX domain sockets (`AF_UNIX`) for IPC. Specifically, the compiler uses the "[abstract](https://www.man7.org/linux/man-pages/man7/unix.7.html)" address format, so the socket is not bound to a specific file path on the system.

I'm using the `linux-sandbox` strategy. It does not seem to isolate these abstract address namespaces.

I'm seeing the compiler in one sandbox accidentally communicating over this IPC to compilers in another sandbox (when multiple sandboxes are run in parallel). This causes problems for the compiler. I'd expect the processes in one sandbox to only be able to talk to the processes in the same sandbox.

With Bazel mostly isolating the sandboxes but not isolating the "abstract" UNIX domain sockets in them, the compiler is unable to run under Bazel.

Is there any existing option that I'm missing to isolate the "abstract" UNIX domain sockets in sandboxes? If not, this seems to be a bug.

Thanks!

### Which category does this issue belong to?

Local Execution

### What's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

_No response_

### Which operating system are you running Bazel on?

Linux

### What is the output of `bazel info release`?

release 8.1.0

### If `bazel info release` returns `development version` or `(@non-git)`, tell us how you built Bazel.

N/A

### What's the output of `git remote get-url origin; git rev-parse HEAD` ?

```text
N/A
```

### If this is a regression, please try to identify the Bazel commit where the bug was introduced with bazelisk --bisect.

N/A

### Have you found anything relevant by searching the web?

Nothing found

### Any other information, logs, or outputs that you want to share?

N/A

Start with Bazel's linux-sandbox strategy and the Linux AF_UNIX documentation linked in the report, focusing on abstract socket namespaces. Reproduce parallel sandboxed compiler processes communicating through an abstract socket, then verify that processes in separate sandboxes can no longer communicate.

Written by the indexing model from the issue text.