thisdir is a context-based sandbox.

Compared to sandboxing tools with fixed access policies per application,
thisdir is designed to be flexible in ad-hoc situations, where the same
application (commonly developer tooling or utilities) may need to be given
different access depending on what the user is doing.  thisdir is also
capable of "interactive" sandboxing, where the policy can be modified
without restarting the sandbox, and denied accesses can be viewed and
allowed in real time by the user.

A "context" is identified by an existing directory within the user's
filesystem, and the context used for sandboxing applications is chosen
based on the current working directory (or a parent directory of the CWD).
