mesh-build-go: run go test, go build and go list in bubblewrap, so a change's code reaches no key, login or network (issue 1309, S1-S6, ADR 0448)

Each run step goes through mesh-sdk's buildstep.Isolated: no network, none of the account,
the workspace read-write, the Go caches beneath a throwaway layer unless the build step is
told publish (a trunk build). The integration level runs its store, its bus and its tests in
one shut-off process (this program again, level <spec>), so they reach each other and
nothing else. build_go_test takes a -run pattern (a try's tests). The module declares the
bubblewrap package and refuses a step, unhealthy, while bwrap is missing or older than 0.10.
The proof test runs a probe test through the real unit level.

modules/mesh-build-go/module.json

@@ -119,6 +119,11 @@
       "type": "package",
       "package": "openssh"
     },
+    {
+      "id": "bubblewrap",
+      "type": "package",
+      "package": "bubblewrap"
+    },
     {
       "id": "postgresql",
       "type": "package",