Hosted macOS unit tests don't run when sandboxed

With the attached sample project if you run `bazel test app:hosted_test --test_output=streamed`, the tests never complete. Adding `--strategy=TestRunner=local`, or setting `tags = ["no-sandbox"]` works around it. In the console logs I see `error kernel Sandbox: xcodebuild(72202) deny(1) job-creation`, but adding `(allow job-creation)` to the sandbox definition here https://github.com/bazelbuild/bazel/blob/ad103c26890d53f5858b1601dcdd029430b20e94/src/main/java/com/google/devtools/build/lib/sandbox/DarwinSandboxedSpawnRunner.java#L340-L343 isn't actually enough. I can't find any sandbox definition that fixes this.

[testsandbox.zip](https://github.com/bazelbuild/rules_apple/files/8336430/testsandbox.zip)

Start by reproducing the issue with the attached testsandbox.zip and `bazel test app:hosted_test --test_output=streamed`. Read the sandbox setup in src/main/java/com/google/devtools/build/lib/sandbox/DarwinSandboxedSpawnRunner.java around lines 340-343 and investigate the reported xcodebuild denial. Done means hosted macOS tests complete without `--strategy=TestRunner=local` or `no-sandbox`.

Written by the indexing model from the issue text.