sandboxes: permission control on merge

[josephjclark]

I think at the moment, any user with access to a project can create and fork a sandbox

It's critical that users have editor privileges on the target (ie, main), before merging

So for any project, editor and up can:

• fork a new sandbox from a project
• Merge a sandbox back into the project

And the creator/forker of a sandbox has Admin access on that project (plus all permissions inherited from that parent)

if this is already implemented then great!