Add sandbox mode to CI testing matrix

[gyfelton]

What changed:

1. Add sandbox on/off to testing matrix, so we have 2 bazel version * VFS on/off * sandbox on off = 8 tests in total ATM
2. Fix redefinition of AppErrorCode enum error in sandbox mode by removing the extra import in bridging header. The tests still works and can catch renaming of the enum for example. Why it was working in non sandbox mode is unknown
3. Add sandbox config to include all settings needed to pass CI. specifically allow a small set of actions to run locally.

Why this change:
To add CI coverage to sandbox mode to ensure no regression on it, now that we have fixed issues with sandbox mode in #894

Discussion:
CI duration might be a concern, we can exclude certain combo in the test matrix if we want, it's possible with exclude keyword

[luispadron]

Some comments on the config. I think it's fine if there's more ci jobs just means PRs take a lil longer to merge but we'll be more confident about the change

[luispadron]

Updated the required check in GitHub this should be ready once CI completes