Use soft constraints for add-source deps in sandboxInstallPolicy.

See #1362. This is an experimental change.