* Don't specify sandbox group (will be same as sandbox user)
* Don't manually create sandbox venv directory
* Move the initial sandbox setup out of deploy.yml to main.yml
* Factor out when: EDXAPP_CODE_SANDBOX to include
* Put profile into complain mode when installing instead of
  disabling altogether
* Add validate= to sudoer template module task
* Use chdir= instead of cd in command
* Use change_when on shell module