Reland "[Mac] Fix form control rendering on 10.14 Mojave."

This is a reland of e7652b9e

Original change's description:
> [Mac] Fix form control rendering on 10.14 Mojave.
> 
> The renderers need to talk to the CVMS server (OpenCL compiler), which
> then outputs codesigned blobs that can be loaded in to the process. This
> is required for drawing the form controls.
> 
> In addition, another Metal bundle location (in /Library) is permitted.
> 
> Bug: 850021, 847518
> Change-Id: I67106972baf5fc55fccd8f7deff3f47cbea076b5
> Reviewed-on: https://chromium-review.googlesource.com/1103127
> Reviewed-by: Greg Kerr <kerrnel@chromium.org>
> Commit-Queue: Robert Sesek <rsesek@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#567877}

Bug: 850021, 847518
Change-Id: Ieb345079a0923d62b034425baacdfc604153c22b
Reviewed-on: https://chromium-review.googlesource.com/1104517Reviewed-by: Greg Kerr <kerrnel@chromium.org>
Commit-Queue: Robert Sesek <rsesek@chromium.org>
Cr-Commit-Position: refs/heads/master@{#568038}

services/service_manager/sandbox/mac/renderer_v2.sb

@@ -18,6 +18,12 @@
   (path "/dev/autofs_nowait")
   (path "/dev/fd"))
 
+; Reads of signed Mach-O blobs created by the CVMS server.
+; https://crbug.com/850021
+(if (>= os-version 1014)
+  (allow file-read-data
+    (prefix "/private/tmp/cvmsCodeSignObj")))
+
 (allow file-write-data
   (require-all
     (path "/dev/null")
@@ -37,6 +43,10 @@
   (subpath "/System/Library/Extensions")  ; https://crbug.com/847518
   (subpath "/System/Library/LinguisticData"))
 
+; Reads from /Library.
+(allow file-read-data
+  (subpath "/Library/GPUBundles"))  ; https://crbug.com/850021
+
 ; IOKit
 (allow iokit-open
   (iokit-registry-entry-class "IOSurfaceRootUserClient")
@@ -54,6 +64,8 @@
   ; crbug.com/792257
   (global-name "com.apple.distributed_notifications@Uv3")
   (global-name "com.apple.lsd.mapdb")
+  ; https://crbug.com/850021
+  (global-name "com.apple.cvmsServ")
   ; crbug.com/792217
   (global-name "com.apple.system.notification_center")
   (global-name "com.apple.windowserver.active"))