feat: enable mixed-sandbox mode by default

[nornagon]

Description of Change

Currently, in order to launch some renderers sandboxed, an app must enable mixed-sandbox mode either with the command-line switch --enable-mixed-sandbox or the app.enableMixedSandbox() API. This PR will deprecate that switch, and make mixed-sandbox mode the default. Renderers launched with sandbox: true will now be actually sandboxed, where previously they would only be sandboxed if mixed-sandbox mode was also enabled.

Depends on #15870 for mixed-sandbox mode to be meaningful on Linux.

Checklist

• PR description included and stakeholders cc'd
• tests are changed or added
• relevant documentation is changed or added
• PR title follows semantic commit guidelines

Release Notes

Notes: Mixed-sandbox mode is now enabled by default. enableMixedSandbox and the --enable-mixed-sandbox command-line switch still exist for compatibility, but are deprecated and have no effect.

[miniak]

Be aware that

• GPU process is going to be sandboxed, this should not have any negative effect on apps
• pepper plugin host processes are going to be sandboxed, this might be a breaking change if apps depend on so-called host-native pepper plugins (should be possible to add an option to opt-out of sandbox for particular plugin / MIME type maybe)

cc @nornagon

[nornagon]

Additionally, devtools processes will be sandboxed.

[MarshallOfSound]

@nornagon will that break devtron?

[zcbenz]

@nornagon
After enabling sandbox mode for devtools process, the devtools extension APIs implementation would switch to use remote for Node.js builtin modules instead of using fs module directly.

However currently remote is not fully supported in devtools process. The devtools extensions are loaded as iframes, so there would be multiple frames using remote module in one process, but the current model of remote assumes only the main frame would use remote module. This results in devtools extensions not working correctly with mixed sandbox mode.

I tried to modify remote to be friendly with multi-frames process, but it turns out to be a harder problem than I expect.

I propose disabling sandbox for devtools process in this PR for now, and enable it after we made remote capable of handling multi-frames process. Otherwise this PR would be blocked for quite a while.

[nornagon]

Pushed a change which unsandboxes devtools processes.

[zcbenz]

@nornagon The Linux CI are still failing for devtools tests, it seems that sandbox are still enabled for devtools process because of zygote process?

[nornagon]

As mentioned in the PR description, this depends on #15870, i think i just need to rebase

[nornagon]

hm, actually it looks like that PR is already merged in the base of this PR. I'll investigate.

[nornagon]

@zcbenz linux tests are now passing; i think the ARM failures are unrelated

[zcbenz]

Looks good to me.

[nornagon]

Talked with @miniak and agreed that we can follow up on the ppapi sandboxing stuff during the beta cycle.

[release-clerk]

Release Notes Persisted

Mixed-sandbox mode is now enabled by default. enableMixedSandbox and the --enable-mixed-sandbox command-line switch still exist for compatibility, but are deprecated and have no effect.