Fix sandbox usage

Issues with Metadata Cleaner and mat2's sandbox in the latest GNOME Flatpak runtime lead me to investigate how mat2 is using its sandbox.

I found the following:

• mat2's --no-sandbox argument is working in reverse (meaning by default no sandbox is used, and passing --no-sandbox would actually use a sandbox)
• When a parser needs child parsers (in archives or FLAC), the sandbox option is not passed down

These commits should fix those issues.