We currently pass startup-handles for Chromium features (e.g. Mojo, FieldTrials, etc) by adding them under the ProcessArgs PA_USER0 "type", with manually-allocated integer identifiers.

We have two main use-cases for passing handles at process startup:
- Well-known: Features like //base FieldTrialList could be configured via a well-known identifier (e.g under POSIX we use an embedder-defined GlobalDescriptors::Key and under MacOS we request the shared-memory handle from a Mach service in the parent process).
- Dynamic: Features like Mojo need to allow an arbitrary number of channels to be passed to the child, and already implement a mechanism for identifying those handles in command-line parameters; we just need a way to generate a guaranteed-unique Id for Mojo to serialize into the command-line.

In practice the FieldTrialList can use the same dynamic-Id mechanism as Mojo, to avoid clashes, but other features may still benefit from being able to pass handles via a well-known path in the child namespace instead.

Work items:
1. Update base::LaunchProcess() to explicitly carve-out PA_USER0 for use by the embedding application.
2. Provide a LaunchOptions helper that adds a handle under the next available PA_USER1 identifier, and returns it for the caller to serialize to the child somehow.
3. [When arbitrary handles can be bound into the FDIO namespace] Provide a helper to manage a well-known handle namespace.