[bazel] Allow SupportTests to be built remotely and cached (#121375)
`SupportTests` fails in the bazel macOS sandbox, because
`FileSystemTest.permissions` expects to be able to modify file
permissions on some otherwise protected files.
Previously this test was marked `local` in bazel, which has
additional undesirable effects such as skipping remote build and cache.
Tighten the bazel tags to just `no-sandbox`. Note in particular, that
this allows the test to build, execute, and cache remotely (if
configured).
Testing:
- Verified this test fails (as expected) on macOS with no tags, and
passes with `no-sandbox`.
- Verified this test passes when executed remotely (using an Engflow RBE
setup) with `no-sandbox`.