deploy/worker/loader-pypi: Add missing private_tmp sandbox option

This sandboxes the temporary directories used for the loader's work.
This allows to clean up dangling files when restarting the service.