Handle tor-powered apps in lockdown mode

counterpart of tpo/applications/vpn#230 (check the description there), since this task requires some work on onionmasq.

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information