FR: Allow for EACCES when enforceSourceReadsUnderPackageRoots is used

A common pattern is to have tools walk up the directory hierarchy and collapse parent configurations. Example packages which do this: eslint, cosmiconfig. However, when enforceSourceReadsUnderPackageRoots is used in BuildXL, this is a bit annoying - it requires that the developer find each package's method to stop traversals (eg, root: true in eslint's config).

These tools generally[^1] handle EACCES errors well, and use that as a signal to stop traversals. Could BuildXL add support for preventing read access, rather than failing the build?

This is related to an open feature request in the esbuild project: https://github.com/evanw/esbuild/issues/4036 - this tool doesn't provide any way to stop the directory traversal, and instead relies on EACCES errors being thrown.

[^1]: I have not conducted a thorough audit of the ecosystem; this is just based on my experience and a light skimming of the source code of several packages.

Start by locating the enforceSourceReadsUnderPackageRoots entry point and the existing handling for EACCES in BuildXL. Review how filesystem reads are currently denied and how sandbox failures are reported. Done means eligible parent-directory reads produce EACCES so traversal-based tools can stop without failing the build, with tests covering the behavior.