Re-enable the tor sandbox when no PTs are used

We have these constraints:

• The tor sandbox is incompatible with the use of PTs
• The tor Sandbox conf cannot be set at runtime but must be changed in torrc followed by a tor restart, which is privileged and cannot be done through the control port

The implementation is: when TCA enables bridges, it disables (via tca-portal) the tor sandbox iff any PT is used.

Closes #18237 (closed)