sessions: Link Dev Container sandbox guidance to documentation - #345007

Fixes #340841

When sandboxing is on, Dev Container sessions start with Docker options (unconfined seccomp, AppArmor and system paths, plus /dev/net/tun) that relax the container's isolation. The Sandboxing in Dev Container toggle's hover listed these options inline. This PR moves the details into the documentation:

• Shorter hover: the hover no longer lists the options but still says they relax the outer container's isolation. The same text remains the switch's accessible name.
• Learn More action: the Agents window permission picker adds a Learn More hover footer action that opens https://aka.ms/vscode-sandboxing-devcontainers. It also appears when the container was started without the required options, with the "recreate the container" guidance.
• Keyboard access: the hover uses tabThroughPanel and expandable (indicator hidden), so keyboard users reach Learn More with Tab or Right Arrow from the focused row.
• Refactor: the hover setup is now one helper shared by the initial item build and the in-place refresh in watchSandboxToggle.

Documentation: microsoft/vscode-docs#10560 (merged into vnext) adds the Use sandboxing in Dev Containers section.

Notes for reviewers

• The aka.ms link is set up: it redirects to https://code.visualstudio.com/docs/agents/run/agent-sandboxing?referrer=in-product#_use-sandboxing-in-dev-containers. The section is merged into vscode-docs vnext (Document Docker options required for Dev Container sandboxing vscode-docs#10560) and goes live with the next release.
• Known keyboard limitation: when the container lacks the options and sandboxing is off, the row is disabled. Action-list keyboard navigation skips disabled rows, so Learn More is reachable by mouse only in that state. Policy-locked rows already behave this way, so it is unchanged here.

How to test

1. In the Agents window, start a new Copilot session in a Dev Container. Make sure sandboxing is available.
2. Open Permissions and hover the Sandboxing in Dev Container row. The hover shows the shorter explanation and a Learn More footer action that opens the docs link.
3. With the keyboard, focus the row and press Tab. Focus moves to Learn More, and Enter opens the link.
4. Reuse a container that was started without sandboxing. The unavailable guidance also offers Learn More.

Validation

• scripts\test.bat --reporter dot --run src/vs/platform/agentHost/test/browser/agentHostSandboxToggle.test.ts --run src/vs/sessions/contrib/providers/copilotChatSessions/test/browser/permissionPicker.test.ts --run src/vs/sessions/contrib/providers/agentHost/test/browser/agentHost/agentHostPermissionPickerDelegate.test.ts: passed (118 tests, including 2 new regression tests)
• npm run typecheck-client: passed
• npm run eslint -- <changed files>: passed