#windows-sandbox: add resolved permissions helper (#22896)