sandboxes: update Provisioner API to support sandboxes

A key requirement of the Sandbox feature is that sandboxes can be created and modified through the CLI.

To that end, there's a bunch of changes needed in the provisioner API to support Sandboxes:

• Allow new sandboxes to be created
• Allow sandboxes to be modified
• Return sandboxes related to a project
• Respond to HEAD requests to tell us if a sandbox exists at a given URL

If a new sandbox is posted:

• the incoming payload will include UUIDs
• The new sandbox state should be returned, plus a URL to access it

The provisioner API should mirror the app: so instead of just asking for a project in the URL, clients will ask for a project and a sandbox. If no sandbox is provided then, for backwards compatibility, the base project is used (ie, default the sandbox to main, which is a synonym for the root project).

Sandboxes will be identified by name, rather than UUID.

provisioner/<projectid>/<sandbox-name>

Sandbox creation may be subject to account limits.

Additionally, the state.json which the provisioner accepts and returns will be a little different, and must support the new keys introduced in #3394

I don't think this is a breaking change, so the updated provisioner should retain full backwards compatibility.

We do want to introduce a strategy for versioning the provisioner API. We could choose to take that on here, but I think we can defer it.