env, buildlet, dashboard: support outbound firewalls for Linux

Updates golang/go#30612

Change-Id: Ib13a286d0944a7f4a13b9e93a01533693052858b
Reviewed-on: https://go-review.googlesource.com/c/build/+/165637
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>

dashboard/builders.go

diff --git a/dashboard/builders.go b/dashboard/builders.go
index ad8dc3f..9c9b4cd 100644
--- a/dashboard/builders.go
+++ b/dashboard/builders.go
@@ -1228,7 +1228,11 @@
 		HostType:          "host-linux-jessie",
 		ShouldRunDistTest: fasterTrybots,
 		tryBot:            defaultTrySet(),
-		env:               []string{"GOARCH=386", "GOHOSTARCH=386"},
+		env: []string{
+			"GOARCH=386",
+			"GOHOSTARCH=386",
+			"GO_DISABLE_OUTBOUND_NETWORK=1",
+		},
 		numTestHelpers:    1,
 		numTryTestHelpers: 3,
 	})
@@ -1239,9 +1243,12 @@
 		env:      []string{"GOARCH=386", "GOHOSTARCH=386", "GO386=387"},
 	})
 	addBuilder(BuildConfig{
-		Name:              "linux-amd64",
-		HostType:          "host-linux-jessie",
-		tryBot:            defaultTrySet(),
+		Name:     "linux-amd64",
+		HostType: "host-linux-jessie",
+		tryBot:   defaultTrySet(),
+		env: []string{
+			"GO_DISABLE_OUTBOUND_NETWORK=1",
+		},
 		MaxAtOnce:         3,
 		numTestHelpers:    1,
 		numTryTestHelpers: 4,
@@ -1305,6 +1312,7 @@
 		Notes:     "cgo disabled",
 		env: []string{
 			"CGO_ENABLED=0",
+			"GO_DISABLE_OUTBOUND_NETWORK=1",
 			// This USER=root was required for Docker-based builds but probably isn't required
 			// in the VM anymore, since the buildlet probably already has this in its environment.
 			// (It was required because without cgo, it couldn't find the username)