Disable file and network access when running the garn file

[jkarni]

There are lots of problems with allowing it, like --help hanging and project structure being potentially not deterministic. From a quick look, it looks like the only offender preventing that right now is go, and there's no reason not to inline the call into the derivation.

This only applies to the normal runner. init should be free to use whatever it wants.

[soenkehahn]

We can't disable network access when running gomod2nix, it has to download go package hashes.