Drop all the `--no-sandbox` bits from tests and infrastructure. Instead, configure Travis to enable user namespace clone.
This patch adds experimental support for Cirrus CI builds. Cirrus CI has both Windows and Linux, uses google cloud and runs builds in Docker containers. This seems to be a promising combination for our needs.