Add app.no_sandbox option to launch browser with --no-sandbox

[CatBraaain]

What

• Add app.no_sandbox (bool, default false); exposed as the --no-sandbox CLI flag
• When true, the browser is launched via go-rod's NoSandbox(true) launcher option
• Document the key with a comment in the app section of config.yaml
• Follows the same explicit opt-in shape as the existing server.insecure option. No new logic — pure wiring, +16 lines across 5 files

Why

On nix-managed non-NixOS hosts (e.g. WSL2), the SUID sandbox helper that Chrome requires cannot be configured: /nix/store is read-only, so chrome-sandbox can never get root:4755. Browser mode therefore dies at launch:

The SUID sandbox helper binary was found, but is not configured correctly.
... make sure that /nix/store/.../chrome-sandbox is owned by root and has mode 4755.

Native NixOS hosts don't hit this because security.wrappers provides a proper setuid wrapper, but hosts that use nix as a package manager have no way to fix it. Pointing browser_path at a shell wrapper that appends --no-sandbox works, but leaves a wrapper script to maintain on every host. With an official option, the plain Chrome binary path works as-is.

Security note

--no-sandbox disables Chrome's renderer sandbox, so:

• The default stays false (no behavior change for existing setups)
• Like insecure, this is an explicit opt-in for environments that cannot run the SUID helper (e.g. read-only /nix/store, root containers)

Testing

• make fmt / go vet / make test (-race, all packages): pass
• On a real nix-on-WSL2 host (google-chrome 151):
  • Default: same SUID FATAL as before (confirmed no behavior change)
  • --no-sandbox flag: duckduckgo search succeeds
  • config no_sandbox: true / env OPENSERP_APP_NO_SANDBOX=true: also succeed