Redesign file sandbox

[davidpanderson]

The file sandbox lets users upload files with 'sandbox names' (mutable).

Current: sandbox has 'link files' (w/ sandbox names) containing size and MD5.
Files are stored download hier with physical name sb__

Problems

• if a file is used as an input file and not marked as no_delete,
  it (the only copy) will be deleted
• you can change a sandbox file while there's an in-progress job using it.
  This is undesirable, and also inefficient to enforce.

Proposal:

• Sandbox has original files, with sandbox names.
  MD5s are stored in md5/sandbox_name.
• To use a sandbox file as a downloadable file
  (input file or app file) you must copy it to the download hierarchy,
  with a name that includes its MD5.
  The default is sb__

Notes:

• In the new scheme, if two sandbox files have the same contents,
  the data is stored twice. That's OK.