Default to whitelist mode and parallelize tests

Flips the default sandbox mode from blacklist to whitelist and
replaces the global RUST_TEST_THREADS=1 with a targeted RwLock
that only serializes blacklist sandboxes against tests mutating
glob-matching host paths. A new Sandbox newtype acquires the
guard automatically when --blacklist is in args.

src/config.rs

@@ -93,7 +93,7 @@ fn merge_mode(
     }
     resolve_mode(profile)
         .or_else(|| resolve_mode(globals))
-        .unwrap_or(SandboxMode::Blacklist)
+        .unwrap_or(SandboxMode::Whitelist)
 }
 
 fn resolve_mode(opts: &Options) -> Option<SandboxMode> {