Block non-loopback inbound traffic for the Windows offline sandbox - #44639

…44639)

## Why

The offline sandbox's non-loopback firewall block covered only outbound traffic. Add a matching inbound block for the offline sandbox user.

## What changed

- Configure an inbound firewall rule scoped to the offline user's SID, blocking all protocols and ports for non-loopback remote addresses.
- Make firewall rule direction explicit while preserving the existing outbound rules.
- Remove the new inbound rule during uninstall.

## Testing

Extend the elevated Windows sandbox integration test to inspect effective inbound and outbound rules, asserting their uniqueness, direction, block action, enabled state, profiles, address and port filters, protocol, and user scope.

GitOrigin-RevId: cbc1ca0d8d08a31fc53da5ad5be6ee5d51afa63d