sandbox: allow access to cookie files, approved-routers

fixes part of 12064
sandbox: refactor string-based option-unchanged tests to use a macro

There was too much code duplication in doing it the old way, and I
nearly made a copy-and-paste error in the last commit.
sandbox: allow reading of hidden service configuration files.

fixes part of 12064