target sandboxing

[mayant15]

We run arbitrary API sequences. This might be undesirable if the library does destructive operations (or anything with files). Wrap executions in a sandbox?

There's three ways to do this:

1. Per-input sandbox, or some batching, which allows us to reset library state for each input, which is important for no false positives if the library has any global state (which imo is kind of rare for JS libraries)
2. Run the entire fuzzer inside a container. Simple but we cannot reset library state between inputs.
3. Something in between. Maybe JS-level sandboxing with guarded file system operations?