Handle opam sandboxing with zig cache more elegantly

[chris-armstrong]

opam sandboxes builds by default on Mac (sandbox-exec) and Linux (bwrap), which interferes with zig's use of a cache located in the user's home directory (particularly on Mac).

#2 tries to fix this by adding a override for the zig cache directories by pointing them to /tmp, but this:

1. Prevents users who have disabled sandboxing from taking advantage of the zig cache. This situation could be improved by better detection of whether the set ZIG cache directory is writable, and enabling them to override it themselves in the environment
2. Could be integrated with opam better - even with sandboxing, opam's wrapper scripts could be updated with an exception for the zig cache (either in the mainline, or by patching it ourselves, or showing the user how to patch it).

This issue should track how to improve the experience with zig's cache instead of a blanket override that prevents its use.

[avsm]

2. is definitely the good option in the long term, but in the short term, you could sneak in the zig cache into a subdirectory of the dune cache ;-) https://github.com/ocaml/opam/blob/master/src/state/shellscripts/sandbox_exec.sh#L53