Sandbox feed checker helper

CatchFeedHelper only gets the "network client" entitlement.

The other thing it needs to do outside of the default sandbox is saving the torrent files. This is accomplished by creating a "bookmark" in the (currently not sandboxed) main app, and then passing it to the helper, which passes along the access permissions as well.

In other words, the helper just "borrows" access permissions to the download folder for a bit. This kind of bookmark doesn't persist across app launches, but we don't care because everything happens on the fly.