Reduce sandbox permissions granted to alternate desktop

This pass adds the first round of deny ACEs for the Winstation and
Desktop objects. Assuming these stick, I'll get more aggressive in
a follow-up.

BUG=346586

Review URL: https://codereview.chromium.org/178423005

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@253415 0039d316-1c4b-4281-b951-d872f2087c98
SVN changes up to revision 253415
Update latest ChromeVox from upstream

BUG=346529
TBR=dtseng,plundblad

Review URL: https://codereview.chromium.org/180413003

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@253416 0039d316-1c4b-4281-b951-d872f2087c98
SVN changes up to revision 253416