sandbox: Use system headers first for sandbox's os.c in a different way

Commit cbe5cdfcd changed config.mk and arch/sandbox/cpu/Makefile
to use -idirafter instead of -I and remove -nostdinc.

But
 * Sandbox-specific code dirties config.mk
 * os.c is compiled without such compiler flags as:
      -Wall -Wstrict-prototypes -Wno-format-security
      -fno-builtin -ffreestanding -fno-stack-protector
      -fstack-usage -Wno-format-nonliteral

This commit use -idirafter and remove the -nostdinc
differently and more simply.

Signed-off-by: Masahiro Yamada <yamada.m@jp.panasonic.com>
Acked-by: Simon Glass <sjg@chromium.org>
diff --git a/config.mk b/config.mk
index b824bb3..60e297a 100644
--- a/config.mk
+++ b/config.mk
@@ -250,16 +250,11 @@
 endif
 endif
 
-# Sandbox needs the base flags and includes, so keep them around
-BASE_CPPFLAGS := $(CPPFLAGS)
-
 ifneq ($(OBJTREE),$(SRCTREE))
-BASE_INCLUDE_DIRS := $(OBJTREE)/include
+CPPFLAGS += -I$(OBJTREE)/include
 endif
 
-BASE_INCLUDE_DIRS += $(TOPDIR)/include $(SRCTREE)/arch/$(ARCH)/include
-
-CPPFLAGS += $(patsubst %, -I%, $(BASE_INCLUDE_DIRS))
+CPPFLAGS += -I$(TOPDIR)/include -I$(SRCTREE)/arch/$(ARCH)/include
 CPPFLAGS += -fno-builtin -ffreestanding -nostdinc	\
 	-isystem $(gccincdir) -pipe $(PLATFORM_CPPFLAGS)