sandbox: chdir into tmpdir before exec to avoid getcwd EPERM

`Sandbox#deny_read_home` (dd8119e) deny-reads home subpaths such as
`~/Documents`, `~/.ssh`, `~/.aws` inside the build/postinstall sandbox.
The sandboxed child inherits the user's CWD from the parent `brew`
invocation, so when the user runs `brew install` from a CWD under one
of those subpaths, the first `getcwd(3)` in the child (e.g. in
`Resource#unpack` or `Mktemp#run`'s block-form `Dir.chdir`) walks across
a denied parent and the install crashes with:

    Error: An exception occurred within a child process:
      Errno::EPERM: Operation not permitted - getcwd

Move the sandbox child into its own tmpdir (under `HOMEBREW_TEMP`) before
`exec` so every subsequent `getcwd` walks only `/opt/homebrew` parents.
The non-block `Dir.chdir` does not itself call `getcwd` and so works
even from a denied CWD. The deny rules added in dd8119e are unchanged.

Only source-style installs were affected; bottles take a different path
that already `cd`s into the Cellar before `getcwd` runs.