[clang] Allow enabling sandbox for direct `-cc1` invocations (#174653)
This PR enables the FS sandbox for direct `clang -cc1` invocations.
https://github.com/llvm/llvm-project/pull/165350 unintentionally
implemented the sandbox only for the code path where `clang -cc1` gets
invoked after being expanded from a driver command line, which reduced
the expected test coverage.