sandbox: enable strict typing

[alebcay]

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same change?
• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your changes? Here's an example.
• Have you successfully run brew style with your changes locally?
• Have you successfully run brew typecheck with your changes locally?
• Have you successfully run brew tests with your changes locally?

---

• Formalize the rule hash as a new subclass SandboxRule with explicit fields
• Raise exception if an unrecognized type is passed to path_filter and pass in a default type from calling code (matching existing default value)

[MikeMcQuaid]

Nice work here, thanks again @alebcay!