Sandbox withholds write access to paths that could be redirected

The sandbox now holds back an allowWrite grant (a path you allowed sandboxed commands to write to) when that path does either of these:

• leads somewhere other than its own spelling, for example through a shortcut-style link
• leads to nothing that exists yet

In both cases a sandboxed command could re-point the path somewhere else. The log notes the grant as withheld and suggests spelling the grant by its real path.

Separately, when blockReadsOutsideWorkingDirectories applies, one more configuration folder is added to the folders re-opened despite denyRead.