blocks-network and allows-network are different for different spawn strategies

Currently, remote execution uses platforms to manage whether tests have network access or not. linux-sandbox uses tags.

This means that we need to define tags and platform requirements for all actions which have requirements different than the default. That's error prone. There should be one way to control requirements across multiple spawn strategies.

This is on Linux, but the OS shouldn't matter here.

Start by comparing the remote execution and linux-sandbox spawn strategies, focusing on how each currently expresses network requirements through platforms or tags. Done means actions can use one consistent mechanism to control network access across spawn strategies without strategy-specific requirements.

Written by the indexing model from the issue text.