Baseline: eeb9c911

Cherry picks:

   + bb7fb2d3:
     Automatically add function transition allow list when needed
   + c59739e7:
     Automated rollback of commit
     f7946d01.
   + f6eabdc5:
     Automated rollback of commit
     774fdb4b.

Incompatible changes:

  - The sandboxfs sandboxing strategy is removed. It hadn't been
    maintained for a long time, it didn't work for most users and it
    was not consistently faster while being complex to set up.
    sandboxfs performance is heavily dependent on the specific setup
    (setup costs are lower, but you have to pay a penalty for the use
    of each input) and there are scenarios where it is faster and
    scenarios where it is slower. Overall it is not worth its weight.
  - Bzlmod is enabled by default, please consider migrating your
    external dependencies from WORKSPACE to MODULE.bazel. Find more
    details at https://github.com/bazelbuild/bazel/issues/18958

Important changes:

  - Directories used by sandboxed non-worker execution may be reused
    to
    avoid unnecessary setup costs. Disable behavior with
    --noreuse_sandbox_directories.
  - Symlink trees created by sandboxing will be deleted
    asynchronously.
    Disable behavior with
    --experimental_sandbox_async_tree_delete_idle_threads=0.

This release contains contributions from many people at Google, as well as Antoine Musso, Benjamin Peterson, Fabian Meumertzheim, Nick Biryulin, Steve Barrau, Thi Don.