Allow sandboxed macOS actions to run /bin/ps

[keith]

Fixes #7448

On Apple Silicon (maybe not exclusively) using rules_foreign_cc without
this you end up seeing many /bin/ps failures when configure scripts
are running.

[tetromino]

On MacOS, non-root users are not allowed to see other users' process list; this means the executables for any general purpose process-listing tool (/bin/ps, /usr/bin/top, the new-fangled procs tool, etc.) must be suid root.

I don't think there's a good reason for a Bazel action to see other users' process list; but on the other hand, carrying around our own limited, sandbox-friendly variant of ps seems a lot of work for no real security gain.

As far as I can tell from reading the ps man page and the ps.c source, the MacOS /bin/ps can't do anything nefarious. We ought to allow it.

I have also verified that (allow process-exec (with no-sandbox) (literal "/bin/ps")) only allows executing /bin/ps - not e.g. /tmp/bin/ps (so it wouldn't allow sneaking in of unrelated unsandboxed binaries under the ps name).