So that the build can't access extra information unintentionally.
Particuarly ANDROID_BUILD_TOP is dangerous.
In the future PATH should be locked down as well.
Bug: 307824623
Test: Added a all_genrules target and built that
Change-Id: I88bb0efb0a82529a1c85875a53cf20c8384d07fe