sandbox: Use system headers first for sandbox's os.c in a different way

Commit cbe5cdfc changed config.mk and arch/sandbox/cpu/Makefile
to use -idirafter instead of -I and remove -nostdinc.

But
 * Sandbox-specific code dirties config.mk
 * os.c is compiled without such compiler flags as:
      -Wall -Wstrict-prototypes -Wno-format-security
      -fno-builtin -ffreestanding -fno-stack-protector
      -fstack-usage -Wno-format-nonliteral

This commit use -idirafter and remove the -nostdinc
differently and more simply.

Signed-off-by: Masahiro Yamada <yamada.m@jp.panasonic.com>
Acked-by: Simon Glass <sjg@chromium.org>