When sandbox network is disabled rules_docker rules cannot communicate with docker daemon

# 🐞 bug report

### Affected Rule

All rules_docker rules that communicate with the Docker daemon, at least:
- container_image
- container_pull
- container_run_and_commit
- container_flatten
- container_layer
- install_pkgs
- add_apt_key

### Is this a regression?

I'm not aware of prior versions where this worked correctly.

### Description

When `--sandbox_default_allow_network=false` and running in `--spawn_strategy=linux-sandbox`, the rules_docker rules cannot communicate with the Docker daemon because the rules do not declare `requires-network` in their `execution_requirements`.

## 🔬 Minimal Reproduction

tbd

## 🔥 Exception or Error

ERROR: /runner/_work/.../BUILD:13:14: Action path/to/target.tar failed: (Exit 1): target.sh failed: error executing command bazel-out/k8-fastbuild-ST-fff/bin/path/to/target.sh

Use --sandbox_debug to see verbose messages from the sandbox and retain the sandbox build root for debugging

Cannot connect to the Docker daemon at tcp://localhost:2376. Is the docker daemon running?

## 🌍 Your Environment

**Operating System:**

  

Ubuntu 22.04

  

**Output of `bazel version`:**

  

Build label: 5.4.0

Build target: bazel-out/k8-opt/bin/src/main/java/com/google/devtools/build/lib/bazel/BazelServer_deploy.jar

Build time: Thu Dec 15 16:14:25 20[22]() (1671120865)

Build timestamp: 1671120865

Build timestamp as int: 1671120865

  

**Rules_docker version:**

  

0.25.0

  

**Anything else relevant?**

Some of the rules_docker rules do not provide a meaningful mnemonic -- the rule that generates `.tar` and add_apt_key, which makes a workaround difficult. At least for my repo, a sufficient workaround is to spec a number of strategy_regexp values and drop back to processwrapper-sandbox, which cannot enforce the network restrictions:

```
--strategy_regexp='Action .*\.tar'=processwrapper-sandbox
--strategy_regexp='Action .*-trusted.gpg'=processwrapper-sandbox
--strategy_regexp=ContainerPushDigest=processwrapper-sandbox
--strategy_regexp=ExtractConfig=processwrapper-sandbox
--strategy_regexp=ExtractImageId=processwrapper-sandbox
--strategy_regexp=ImageLayer=processwrapper-sandbox
--strategy_regexp=JoinLayers=processwrapper-sandbox
--strategy_regexp=RunAndCommit=processwrapper-sandbox
--strategy_regexp=RunAndCommitLayer=processwrapper-sandbox
--strategy_regexp=RunAndExtract=processwrapper-sandbox
```