This autotest https://cs.corp.google.com/chromeos_public/src/third_party/autotest/files/client/site_tests/security_SandboxedServices/ should be updated to enforce that sandboxed services in CrOS only get the runtime capabilities that they are expected to get

Mostly to make it clear if there is ever a time we are widening runtime capabilities for a service.