BaseContainer: rename not allowed in TEMP folder

### Relevant area(s)

Windows

### Brief description of your issue

When a process is launched in a process container sandbox with T1 support (BaseContainer PSEC) the %TEMP% env var is set to something like `C:\Users\\AppData\Local\P\Packages\sandbox.{271fc3b3-bc0b-4ead-bb14-ad5226896536}\AC\Temp` with a random guid that is different each time. However, that folder doesn't have sufficient permissions as it allow creation and deletion of file within but not rename and that is creating some issues with programs like npm and dotnet.

As a workaround I have to give readwrite permission to `C:\Users\\AppData\Local\P\Packages\` (since I cannot predict the guid) however is not correct since it give permission to other package folders as well. Giving this permission renames are allowed.

### Steps to reproduce

Launch a program in a process container sandbox that creates and then rename files in the TEMP folder.

### Expected behavior

I expect that the program is able to create and delete files in its own TEMP folder.

### Actual behavior

It gets access denied during renaming.

Start with the Windows BaseContainer PSEC/T1 sandbox setup and reproduce the access-denied rename in the generated TEMP folder. Inspect how permissions are assigned to that folder, then verify that a sandboxed process can create, rename, and delete files in its own TEMP directory without granting access to other package folders.

Written by the indexing model from the issue text.