Clean up Windows sandbox resources on app uninstall (#42375)

## What changed

- Record the authenticated sandbox owner and observe package uninstall events across service restarts and session changes.
- During uninstall, serialize setup and cleanup, disable sandbox accounts, stop their processes, and remove sandbox directories, firewall and WFP rules, hidden-user entries, accounts, and the sandbox group.
- Restrict desktop-owned directory cleanup to pinned paths and perform it while impersonating the authenticated owner.
- Detect missing or disabled sandbox accounts after interrupted cleanup and reprovision them before restoring network access.

GitOrigin-RevId: 7d63fff7ddcff3eb01d018653146df12044bd277

codex-rs/windows-sandbox-rs/Cargo.toml

@@ -74,6 +74,7 @@ features = [
     "Win32_System_Memory",
     "Win32_System_Kernel",
     "Win32_System_Console",
+    "Win32_System_RemoteDesktop",
     "Win32_Storage_FileSystem",
     "Win32_System_Diagnostics_ToolHelp",
     "Win32_NetworkManagement_NetManagement",