Support creating shared buffers and data pipes in sandboxed processes

[krockot]

We should try to reuse the Broker stuff from the new EDK to get shared buffers created synchronously for sandboxed processes.

[krockot]

not considering this to be a blocker as neither the old nor new EDK supports this either, and nobody currently depends on it. we should support it probably, but it will always require sync IPC on POSIX and that's pretty unfortunate. might be just as well to say they can't be created in a sandbox, and require users to have privileged unsandboxed services do all their data pipe / shared buffer creation for them.