Allow disabling boolean flags from the CLI

Pair --hardened, --dry-run, and --unshare-net (renamed from --no-net)
with negation counterparts so a CLI invocation can override a truthy
config-file or profile value.

src/sandbox.rs

@@ -13,7 +13,7 @@ pub fn build_command(config: &SandboxConfig) -> Result<Command, SandboxError> {
         cmd.args(["--unshare-ipc", "--unshare-pid", "--unshare-uts"]);
         cmd.args(["--hostname", "sandbox"]);
     }
-    if config.no_net {
+    if config.unshare_net {
         cmd.arg("--unshare-net");
     }