(merge) media: Allow third party modules in MediaFoundationCdm sandbox

Some codec packs (e.g. DolbyVision) might be provided by third party
directly and not signed by MS. To allow those playback, allow third
party modules in the MediaFoundationCdm sandbox.

Tested with DolbyVision content in a custom build.

(cherry picked from commit e3bbf18)

Bug: 1316716
Change-Id: I68c9f8b86635200886815344375cbee8b33d778b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3588221
Reviewed-by: Frank Li <frankli@microsoft.com>
Reviewed-by: Will Harris <wfh@chromium.org>
Commit-Queue: Xiaohan Wang <xhwang@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#993055}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3595281
Auto-Submit: Xiaohan Wang <xhwang@chromium.org>
Cr-Commit-Position: refs/branch-heads/5005@{#51}
Cr-Branched-From: 5b4d945-refs/heads/main@{#992738}

sandbox/policy/win/sandbox_win.cc

@@ -1035,7 +1035,8 @@ ResultCode SandboxWin::GeneratePolicyForSandboxedProcess(
   // Post-startup mitigations.
   mitigations = MITIGATION_DLL_SEARCH_ORDER;
   if (!cmd_line.HasSwitch(switches::kAllowThirdPartyModules) &&
-      sandbox_type != Sandbox::kSpeechRecognition) {
+      sandbox_type != Sandbox::kSpeechRecognition &&
+      sandbox_type != Sandbox::kMediaFoundationCdm) {
     mitigations |= MITIGATION_FORCE_MS_SIGNED_BINS;
   }