Use sandbox flags from policy container on commit

This removes the commit navigation params |sanbox_flags| and replaces
its usage with the value contained in the policy container.
This benefits from the policy container's handling of inheritance.
This change itself affects a significant amount of renderer code as
several classes are simulating the browser behavior (test helpers) and
some corner cases need to be handled (documents committed without browser involvement).

Bug: 1148405
Change-Id: Icd210a0fb4645fff6433b4118c332cf190ce8bd6
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3481495
Reviewed-by: Arthur Sonzogni <[email protected]>
Reviewed-by: Yutaka Hirano <[email protected]>
Reviewed-by: Colin Blundell <[email protected]>
Reviewed-by: Daniel Cheng <[email protected]>
Commit-Queue: Pâris Meuleman <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1020799}
diff --git a/content/browser/renderer_host/navigation_controller_impl.cc b/content/browser/renderer_host/navigation_controller_impl.cc
index 1513d6d6..d7f2f70 100644
--- a/content/browser/renderer_host/navigation_controller_impl.cc
+++ b/content/browser/renderer_host/navigation_controller_impl.cc
@@ -3769,8 +3769,7 @@
           frame_entry->committed_origin(),
           // The correct storage key will be computed before committing the
           // navigation.
-          blink::StorageKey(), network::mojom::WebSandboxFlags(),
-          override_user_agent, params.redirect_chain,
+          blink::StorageKey(), override_user_agent, params.redirect_chain,
           std::vector<network::mojom::URLResponseHeadPtr>(),
           std::vector<net::RedirectInfo>(), params.post_content_type,
           common_params->url, common_params->method,