Enable the Chromium sandbox when the system supports it

[linesight]

cefpython has always disabled Chromium's sandbox on Linux. Historically this was done with no_sandbox = 1 in CefSettings; as of the cefpython 147 work it's a --no-sandbox command-line switch instead. Either way the sandbox is off, but it's an important security feature and we should enable it where we can. Opening this to track that.

[cztomczak]

This issue is too narrowly scoped. Sandboxing has historically been disabled on all platforms in cefpython, not just Linux. Before working on Linux-specific changes, we should first investigate sandbox support across all platforms in recent CEF versions. That includes understanding whether the current cefpython architecture, using a separate subprocess executable, still prevents enabling sandboxing, or whether this has changed. Based on that research, we can then decide what platform-specific work is actually needed.

[cztomczak]

From what I understand the new code in PR disables sandbox on linux in sub-processes, so on other platforms sandbox may still be enabled in sub-processes.

[linesight]

Issue title is updated