Motivation for this change

While attempting to package yocto, which is a source based tool chain to build embedded Linux OSes I found it was downloading binaries to bootstrap compilation of Rust and other langs. I then switched to FHSUserEnv but my host /lib was still available within the chroot so binaries kept breaking because, I believe, a mismatch of glibc versions across chroot and host.

To make the chroot more pure, I have added "lib", "lib64", "lib32", "sbin" to the chroot blacklist.
I believe that Steam makes heavy use of this so I need to test that before merging.

Maybe it would be better to have a custom set of blacklists (or even whitelists) when creating this chroot? If that is preferable let me know and I'll try to implement.

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Fits CONTRIBUTING.md.