Backport MR 350 about SAVECONF vs Sandbox (#40317)

This backports !350 (closed) (fixing #40317 (closed)) to tor 0.4.5.x.

I did some basic testing, and couldn't find any problems. In particular, it solves Tails#18237 as expected!