processcontainer: support device-class capabilities (e.g. webcam) — capability strings are always hashed via DeriveCapabilitySidsFromName

[nitinkothwal]

Description of the new feature / enhancement

Allow a ProcessContainer policy to grant device-class capabilities, and emit them verbatim instead of hashing them. For example:

"processContainer": {
  "capabilities": ["internetClient"],
  "deviceCapabilities": ["webcam", "microphone"]  // named, mapped by MXC to their device-class SIDs
  // or: ["{E5323777-F976-4F5B-9B55-B94699C46E44}"]  // raw interface-class GUID
}

Ideally:

• Named aliases for the common sensitive devices (webcam, microphone, location), mapped to both the name-derived SID and the device-class SID, matching what <DeviceCapability> produces for packaged apps.
• Fail closed if a tier can't apply a requested device capability, in line with "never silently omit a requested restriction". The same applies in reverse: never silently drop a requested grant without an error.
• The tier's actual behaviour documented, including whether Windows camera and microphone privacy settings are still honoured for an unpackaged container.

Proposed technical implementation details

No response