Disable child user grant permissions to extensions when pref is false

When the "Permissions for sites and apps" toggle in Chrome family
dashboard is disabled, we should prevent child users from installing
new extensions and approving additional permissions for existing
extensions. This CL focuses on preventing child users from granting
approval for additional permissions. When the toggle is disabled, pref
kSupervisedUserExtensionsMayRequestPermissions becomes false, and this
is used to implement the desired effects in this CL.

Bug: 1018956
Change-Id: I492e9ffa2b5b4c923160c54aebbbc8a5622849a3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1929032Reviewed-by: Devlin <rdevlin.cronin@chromium.org>
Reviewed-by: Michael Giuffrida <michaelpg@chromium.org>
Commit-Queue: Toby Huang <tobyhuang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#719714}

chrome/browser/supervised_user/supervised_user_service.cc

@@ -747,6 +747,12 @@ SupervisedUserService::ExtensionState SupervisedUserService::GetExtensionState(
       // extensions should not be affected.
       return ExtensionState::BLOCKED;
     }
+    if (ExtensionPrefs::Get(profile_)->DidExtensionEscalatePermissions(
+            extension.id())) {
+      // Block child users from approving existing extensions asking for
+      // additional permissions.
+      return ExtensionState::BLOCKED;
+    }
   }
 
   auto extension_it = approved_extensions_map_.find(extension.id());