Keep the ImageDecoder sandbox available in sanitizer builds, but opt the
helper out of LeakSanitizer process-exit leak scans. LSan inspects
procfs during that scan, which conflicts with the helper filesystem
sandbox.
Skip the glibc malloc arena tweak under ASan as well, since ASan's
allocator makes mallopt(M_ARENA_MAX) fail and does not need that glibc
runtime workaround.
