Convert migrate_sandbox functional test to kernel test.

Problem/Motivation

There's a functional test that is intended to assure that access to the migrate_sandbox is restricted. It could just as easily be a Kernel test that asserts the permission specified on the route as well as that the permission is defined as restricted access.

Kernel tests are faster and use fewer resources than functional tests. I might as well make the change!