Fix warning when HAVE_EMBEDDED_SANDBOX_SHELL is not set

Clang doesn't like the double indent that is needed for the `if...else`
that is CPP'd away. Adding braces is fine in the `if...else...` case,
and fine as a naked block in the CPP'd away case, and properly-indented
both ways.

src/libstore/unix/build/linux-derivation-builder.cc

@@ -685,7 +685,9 @@ struct LinuxDerivationBuilder : DerivationBuilderImpl
                 chmod_(dst, 0555);
             } else
 #  endif
+            {
                 doBind(i.second.source, chrootRootDir + i.first, i.second.optional);
+            }
         }
 
         /* Bind a new instance of procfs on /proc. */