fix: set nativeWindowOpen when sandboxed

[miniak]

Description of Change

Backport of: #18273

Checklist

• PR description included and stakeholders cc'd
• npm test passes
• tests are changed or added
• PR title follows semantic commit guidelines
• PR release notes describe the change in a way relevant to app developers, and are capitalized, punctuated, and past tense.

Release Notes

Notes:

• Fixed issues with popups created from sandboxed <webview>:
• Clicking link with target="_blank" not emitting 'new-window' event.
• window.open() not returning null when allowpopups is not set.

[zcbenz]

@MarshallOfSound I saw you explained concerns about backporting it to 4/5 in #18273, are you OK with this backport?

[MarshallOfSound]

@zcbenz My concerns still apply and I would have preferred this went through @electron/wg-releases to get the backport approved given my voiced concern in the original PR. My approval on the original PR was actually directly conditional on it not being an approval of the backport.

I'm like -0 on this, if other folks want to merge it go ahead but I stand by the fact that it is a decently large change in behavior to float in a patch release.

[jkleinsc]

Pending Releases WG approval

The Releases WG has chosen to approve this backport per latest meeting

[release-clerk]

Release Notes Persisted

• Fixed issues with popups created from sandboxed <webview>:
• Clicking link with target="_blank" not emitting 'new-window' event.
• window.open() not returning null when allowpopups is not set.