Allow to enable `sandbox` behind a setting and validate it works

The idea is to eventually enable this by default in insiders. 

**Things to check:**
* [ ] 🏃 There are no issues from the `contextBridge` when using the exposed API from our preload script
* [ ] 🏃 Investigate the impact on running as admin when `sandbox: true`
* [ ] 🏃 Performance validation & tuning