Sandboxes in a compartment reach each other by name

With the private network on, sandboxes created by keys in the same compartment can now connect to each other at <name>.sandbox.internal or <id>.sandbox.internal. Before, every connection from a compartment's sandbox was refused with private-network-off. Compartments stay walled: a sandbox reaches only sandboxes of its own compartment, or, outside every compartment, only the account's other sandboxes outside every compartment. A name across the wall returns 502 with private-network-no-sandbox.