check for dangling symlinks before copying outputs out of the sandbox

`SkyframeActionExecutor` raises an error if an action outputs a dangling symlink. The occurrence of this error may be non-deterministic for nonhermetic actions as this example shows:
```
$ cat BUILD
genrule(
name = 'make-target',
outs = ['target'],
cmd = "touch $@",
)

genrule(
name = 'make-link',
outs = ["link"],
cmd = "ln -s target $@",
)
$ bazel build :link
ERROR: BUILD:7:1: declared output 'link' is a dangling symbolic link.
ERROR: BUILD:7:1: not all outputs were created or valid.
$ bazel build :target
INFO: Found 1 target...
Target //:target up-to-date:
bazel-genfiles/target
INFO: Elapsed time: 0.206s, Critical Path: 0.04s
$ bazel build :link
INFO: Found 1 target...
Target //:link up-to-date:
bazel-genfiles/link
INFO: Elapsed time: 0.164s, Critical Path: 0.03s
```

It's unfortunate that the success of `:link` depends on whether `:target` has been built or not. The underlying problem is, of course, that `:make-link` is nonhermetic as it fails to declare `:target` as an input. This type of incorrectness could be deterministically flagged for sandboxed actions by checking for dangling symlinks before copying the outputs out of the sandbox execroot to the real execroot.