Use OS-Lib's `pwdDynamicFunction` to allow sandboxing of `os.pwd`, write sandboxing doc page, introduce `RunModule#runner` #7922

Job	Run time
build-linux / build	3m 29s
build-windows / build	4m 26s
compiler-bridge / build	1m 39s
format-scalafix-bincompat / build	3m 29s
linux (11, '{scalajslib,scalanativelib}.__.testCached') / build	3m 30s
linux (11, 'example.{depth,extending}.__.local.testCached') / build	3m 31s
linux (11, 'example.thirdparty[{mockito,acyclic,commons-io}].local.testCached') / build	3m 31s
linux (11, 'integration.{failure,feature,ide}.__.local.testCached') / build	3m 30s
linux (11, git fetch --tags && ./mill -i docs.githubPages) / build	14s
linux (17, '{main,scalalib,testrunner,bsp,testkit}.__.testCached') / build	3m 29s
linux (17, 'example.javalib.__.local.testCached') / build	3m 30s
linux (17, 'example.thirdparty[{fansi,jimfs,netty,gatling}].local.testCached') / build	3m 30s
linux (17, 'example.scalalib.__.local.testCached') / build	3m 30s
linux (17, 'integration.invalidation.__.server.testCached') / build	3m 30s
linux (17, 'integration.invalidation.__.fork.testCached') / build	3m 30s
linux (17, contrib.__.testCached) / build	3m 31s
itest (17, ci/test-mill-bootstrap.sh) / build	3m 28s
itest (11, ci/test-mill-dev.sh && ci/test-mill-release.sh && ./mill -i -k __.ivyDepsTree && ./mil... / build	3m 21s
windows	0s
publish-sonatype	1s
release-github	1s
	58m 40s

Provide feedback