Allow disabling boolean flags from the CLI

Pair --hardened, --dry-run, and --unshare-net (renamed from --no-net)
with negation counterparts so a CLI invocation can override a truthy
config-file or profile value.

src/lib.rs

@@ -22,7 +22,7 @@ pub enum SandboxMode {
 pub struct SandboxConfig {
     pub mode: SandboxMode,
     pub hardened: bool,
-    pub no_net: bool,
+    pub unshare_net: bool,
     pub extra_rw: Vec<PathBuf>,
     pub extra_ro: Vec<PathBuf>,
     pub mask: Vec<PathBuf>,