GitLab

Adds a new |SandboxType::kIconReader| with token and integrity
levels that allow PrivateExtractIcon to do its thing. The service is
only used for PE files which, as a complex format, should not
be parsed in the browser. Other icons are found based only on a
file's extension. These are handled in the browser as this is both
faster and allows a tighter sandbox to be applied to the PE file
parsing. PrivateExtractIcon (a documented but discouraged Windows API)
is used instead of SHGetFileInfo as SHGetFileInfo requires COM
which considerably weakens sandboxing.

Adds basic icon loading test for all platforms.

A follow-on CL will add a fallback for PE files for which no embedded
icon is available.

Testing: adds a unit test for groups, plus
manual testing on Windows 7 x86 and Windows 10 x64.

Bug: 1032250
Change-Id: I6975e5612d8b6f35e3216a67fc98592a45895c1b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1987273
Commit-Queue: Alex Gough <ajgo@chromium.org>
Reviewed-by: Robert Liao <robliao@chromium.org>
Reviewed-by: Will Harris <wfh@chromium.org>
Reviewed-by: Avi Drissman <avi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#779502}