update sandbox flag list

Missing allow-pointer-lock and allow-popups.