this actually was defective even with local urls...
as we pass files through the portal the sandbox gets irrelevant portal
paths a la /run/foo/bar/yolo.txt when the sandbox then gives us that
path back, the directory isn't meant to be written to, much less shown
to the user to begin with.

to deal with this scenario we now do a reverse resolution dance on
savefile. notably we first ask the portal to translate the portal file
name in /run to the actual file name underneath it. we then run that
path through kio-fuse in case it was fuse mounted

this renders /run to /home/foo/yolo.txt or when it was fuse mounted for
example smb:///foo/yolo.txt

the effective end result is that when you open a file in okular from a
samba share and then save-as, the file save dialog will show the smb://
url not the fake /run url

BUG: 452968