Fix sandbox policy for print compositor

When the policy controlling the print compositor LPAC sandbox was
set to disable LPAC, but the feature was enabled (the default) the
app container profile was correctly being removed however
the default policy was being disabled and incorrect token level
and integrity level was being used.

This CL fixes the glitch by making the feature and policy behavior
consistently disable LPAC, and use the restricted token sandbox
in that case.

The existing test is augmented to check all the parameters of
the sandbox are valid for when the LPAC sandbox is used (or not).

BUG=370538340

Change-Id: I374a6abe7abbb57f327ac5dce4462c84cf0071ff
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5913498
Commit-Queue: Will Harris <wfh@chromium.org>
Reviewed-by: Alex Gough <ajgo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1365760}