Read-only access to the filesystem from compiler sandbox

We have discussed things like CompilerSandboxGranularity but in fact the only real-world use cases for relaxing the compiler sandbox that we have found so far are to read files from the project directory and incorporate them into macroexpansion.

In light of this, creating a nuanced system to express various different capabilities is probably not worth the effort, and we should just allow macros to read from disk in a limited way.