Function restrict_config 

pub(crate) fn restrict_config(
    config: &mut Config,
    allow_ffi: bool,
    allow_network: bool,
)

Turns off ffi unless allow_ffi, and removes the RPC and Etherscan settings unless allow_network. Every workspace of a Sandbox writes this config, so no generated test can call vm.ffi or reach an endpoint that the config names. Config ignores FFI environment variables.