Splitting this off from #1818104: Port the sandbox-to-full permissions to D7. It'd be nice if all the full vs. sandbox functionality lived in a separate module so that sites that don't need the complication don't have to have it. However, time is too short before the d.o D7 launch, so this will have to wait for a post-launch cleanup.