[AdamMagued]

Closes #59

Summary

Decouple LANDLOCK_ACCESS_NET_BIND_TCP from LANDLOCK_ACCESS_NET_CONNECT_TCP when --unrestricted-network is combined with TCP bind restrictions.

Changes

• Configure Landlock with AccessNetBindTCP only when UnrestrictedNetwork is enabled alongside BindTCPPorts or RestrictBindTCP, leaving AccessNetConnectTCP unhandled so outbound connections remain permitted.
• Add --restrict-bind-tcp flag to deny all TCP bind attempts when --unrestricted-network is active without specific allowed ports.
• Add --unrestricted-egress as an alias for --unrestricted-network.
• Extract BuildLandlockConfig in internal/sandbox and parseSandboxConfig in cmd/landrun for unit testing.
• Validate TCP port bounds (0-65535) prior to rule construction.

Verification

• Added unit tests in cmd/landrun/main_test.go and internal/sandbox/sandbox_test.go covering decoupled bind restrictions, explicit bind denials, unrestricted egress, and port range validation.
• Added integration test cases in test.sh verifying allowed binds, denied binds, and permitted outbound connections under --unrestricted-network.
• Executed go test ./... -v and go vet ./... in Linux container sandbox.

[Zouuup]

Thanks @AdamMagued , happy to merge when conflicts are resolved.

[AdamMagued]

Rebased onto main and resolved merge conflicts. Sandbox tests and vet pass cleanly.