sandbox: prevent non-empty list model on destruction

The parent-provides model is destroyed if no <parent-provides> node is
found in the configuration, which resulted in

  Warning: list model not empty at destruction time

and leaking memory for the allocated nodes. The commit now explicitly
empties the list model in the destructor of ~Parent_provides_model.

Note, the case is implicitly tested in pkg/test-init by step "denial of
forwarded session request" and <init_config version="empty">.

Thanks to Peter for reporting this issue.

Fixes #4547

repos/os/recipes/pkg/test-init/runtime

@@ -5,6 +5,7 @@
 	<events>
 		<timeout meaning="failed" sec="330" />
 		<log meaning="succeeded">child "test-init" exited with exit value 0</log>
+		<log meaning="failed">list model not empty at destruction time</log>
 	</events>
 
 	<content>

repos/os/src/lib/sandbox/config_model.h

@@ -73,6 +73,11 @@ struct Sandbox::Parent_provides_model : Noncopyable
 		_alloc(alloc), _verbose(verbose), _factory(factory)
 	{ }
 
+	~Parent_provides_model()
+	{
+		update_from_xml(Xml_node("<empty/>"));
+	}
+
 	void update_from_xml(Xml_node const &xml)
 	{
 		bool first_log = true;