Upload-only mode for vfolders

There are several customer requests to prevent downloads from vfolders, while allowing users to access/read/process the contents in compute sessions (i.e., free to read in the server side only).

Technically it is **_not possible_** to ultimately prevent copying the information bits (e.g., if users really want to do this, they can just print the files byte-by-byte on the screen and copy-and-paste them...), still it is **worth** to provide a download-block mechanism for commonly used container apps such as scp/sftp and jupyter considering that the data size is _usually very large_.

Let's explore how we could achieve this for commonly used apps:

- scp
- sftp\* https://serverfault.com/questions/1016236/is-it-possible-to-disable-download-from-openssh-sftp-server

- jupyter and jupyterlab\* https://github.com/jupyterlab/jupyterlab/issues/5274
- https://discourse.jupyter.org/t/request-for-implementations-disabling-downloads-from-a-jupyterhub/7613
- https://stackoverflow.com/questions/54425431/disabling-downloads-on-jupyter-notebooks

- filebrowser
Maybe we need to fork and patch these apps and/or find out some hidden configuration options.

We could also modify the app proxy to perform DPI (deep packet inspection), but it will severly impact the user experience in terms of container app responsiveness. I think it would be better to modify/configure the container apps instead.

## High-level design in the Backend.AI side

- **manager**: Add a new per-vfolder attribute to specify whether the download is blocked or not.\* We may need to add an RBAC option to allow/disallow creation of downloadable vfolders for specific users or projects.

- **agent**: Apply additional configurations/patches when creating new containers that include mounts of such vfolders.\* It would be nice to distinguish individual vfolders to allow/block downloads, but I think it is okay to take the lowest common permission level: if one vfolder needs to be download-blocked, all other vfolders in the same session are also download-blocked.

JIRA Issue: BA-133