Previously, we used a hack for reinstalling reverse dependencies: we created an
install plan for the sandboxed package and the modified add-source deps and then
pruned the sandboxed package from it. This missed those revdeps that the
sandboxed package didn't depend on and also broke the sandboxed package if it
was installed in the sandboxed package DB (see #1229).

This commit replaces that hack with a more principled approach: we create a plan
for the whole environment (all packages installed in the sandbox), constraining
the modified add-source deps to be reinstalled and the already installed
packages to be preferably not.

Fixes #1229.