`OFSandbox` currently only supports `pledge()` / `unveil()`. Adding Landlock would make sure that API works well with different sandboxing systems.