Sandbox: allow access to stats/bridge-stats

Fix for 12041; bugfix on 0.2.5.1-alpha.
Fix a sentence that I never
Oops; permit rename with the correct filename
sandbox: Permit access to stats/dirreq-stats

This prevents a crash when rotating logs with dirreq-stats enabled

fixes 12035; bugfix on 0.2.5.1-alpha.
sandbox: Disallow options which would make us call exec()

None of the things we might exec() can possibly run under the
sanbox, so rather than crash later, we have to refuse to accept the
configuration nice and early.

The longer-term solution is to have an exec() helper, but wow is
that risky.

fixes 12043; bugfix on 0.2.5.1-alpha
sandbox: tolerate reloading with DirPortFrontPage set

Also, don't tolerate changing DirPortFrontPage.

Fixes bug 12028; bugfix on 0.2.5.1-alpha.
doc/HACKING: Improve documentation of how to bump version in maint

See discussion on 9553: Some of the build scripts don't like it when
you can't merge maint into release.
sandbox: support logfile rotation

Fixes bug 12032; bugfix on 0.2.5.1-alpha
fix a wide line
sandbox: permit gettid, sched_getaffinity

These are needed under some circumstances if we are running with
expensive-hardening and sandbox at the same time.

fixes 11477, bugfix on 0.2.5.4-alpha (where we introduced
expensive-hardening)