Add support for custom working directory in Python SandboxExec.

Add support for configuring the container working directory and per-command
working directory overrides in the Python SandboxExec bindings (gvisor.sandbox).

Features introduced:
- Added working_dir parameter to Sandbox.__init__ to configure the initial
  working directory inside the container (written to spec.process.cwd in
  config.json). Defaults to "/".
- Added _normalize_working_dir private module-level helper to normalize and
  validate working directory paths into absolute POSIX paths.
- Added cwd parameter to Sandbox.exec to support per-command execution directory
  overrides via the '--cwd' flag passed to runsc exec.
- Added comprehensive unit test coverage for default/unset working_dir, custom
  paths, relative path normalization, invalid values, and exec cwd overrides.

PiperOrigin-RevId: 963705877