sandbox: Complete migration away from os_malloc()

Now that we can use direct access to the system malloc() in sandbox, drop
the remaining uses of os_malloc().

The only one remaining now is for the RAM buffer, which we do want to be
at a known address, so this is intended.

Signed-off-by: Simon Glass <sjg@chromium.org>