[llvm][clang] Sandbox filesystem reads

[jansvoboda11]

This PR introduces a new mechanism for enforcing a sandbox of filesystem reads from the compiler. A fatal error is raised whenever the llvm::sys::fs APIs get used directly instead of going through the blessed virtual interface of llvm::vfs::FileSystem.

[github-actions]

⚠️ C/C++ code linter clang-tidy found issues in your code. ⚠️

You can test this locally with the following command:

git diff -U0 origin/main...HEAD -- clang-tools-extra/clang-tidy/llvm/IOSandboxCheck.cpp clang-tools-extra/clang-tidy/llvm/IOSandboxCheck.h clang-tools-extra/clang-tidy/llvm/LLVMTidyModule.cpp |
python3 clang-tools-extra/clang-tidy/tool/clang-tidy-diff.py \
  -path build -p1 -quiet

View the output from clang-tidy here.

clang-tools-extra/clang-tidy/llvm/IOSandboxCheck.h:7:9: warning: header guard does not follow preferred style [llvm-header-guard]
    7 | #ifndef LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_LLVM_IOSANDBOXCHECK_H
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      |         LLVM_IOSANDBOXCHECK_H
    8 | #define LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_LLVM_IOSANDBOXCHECK_H
      |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      |         LLVM_IOSANDBOXCHECK_H