Allow non-fast-forward git pushes for sandbox repositories (only)

Problem

• Whenever I have to rebase a branch in my sandbox against the latest HEAD of the originating project (Drupal core), then I have to use this strange combination of commands, because git.drupal.org globally denies non-fast-forward pushes:

  $ git push --delete platform extension-disco-sun
  To sun@git.drupal.org:sandbox/sun/1255586.git
   - [deleted]         extension-disco-sun
  

  $ git push -u platform extension-disco-sun
  Counting objects: 364, done.
  Delta compression using up to 4 threads.
  Compressing objects: 100% (270/270), done.
  Writing objects: 100% (283/283), 43.45 KiB, done.
  Total 283 (delta 186), reused 0 (delta 0)
  To sun@git.drupal.org:sandbox/sun/1255586.git
   * [new branch]      extension-disco-sun -> extension-disco-sun
  Branch extension-disco-sun set up to track remote branch extension-disco-sun from platform.
  

Proposed solution

1. Allow non-fast-forward pushes for sandbox repositories.

2. Simply identify sandbox repositories by the pathname in the repository URI; i.e., /\bsandbox\//

   → I'm aware (AFAIK) that the URIs are just filesystem aliases, so it is theoretically possible to push to a sandbox repo in order to update an official repo - in which case the non-fast-forward protection would be skipped. However, I'm interpreting this entire protection only as a convenience feature in the first place. That's fine, but it shouldn't be git.drupal.org's job to ensure a 100% safe/reliable protection.