Sandboxes: upload links replace files in root-owned folders

A PUT link from POST /v1/sandboxes/{id}/files:link to a path under /workspace whose folder is owned by root (for example, a tarball extracted with sudo) returned 404 with This upload is not open in the sandbox. The upload now replaces the file atomically, as files_write does, and the new file is owned by the sandbox user. When the sandbox user cannot write the folder (outside /workspace), the link returns 403 permission_denied with the folder named, instead of 404.