Move memory-footprint sampling to a UIProcess `MemoryFootprintMonitor`

Component: WebKit UIProcess | 8009ddd

WebKit enforces foreground and background memory limits per page so that it can terminate a process before the OS OOM-kills the whole application. Previously each sandboxed WebProcess measured its own phys_footprint via task_info(mach_task_self(), ...) every 30 seconds and reported that number for limit enforcement. On iOS the app sandbox blocks task_name_for_pid for any pid other than the caller's own, so the UIProcess cannot simply obtain a WebProcess's task name port for itself.

This commit moves sampling into a new UIProcess-side MemoryFootprintMonitor that measures every non-suspended WebContent process directly. To make that possible on iOS, WebProcess sends its task_name_port — a restricted Mach port variant permitting only a few task_info flavors, not memory read/write or thread control — to the UIProcess over a new setTaskNamePort IPC message on WebProcessProxy, after which the UIProcess calls task_info on that port itself.

Significance

Memory-limit enforcement no longer depends on a number that the sandboxed renderer reports about itself. The primary motivation is Site Isolation, where a single page can span multiple WebProcesses and per-process self-sampling can no longer correctly enforce a per-page limit; removing a renderer-controlled data source from a termination decision is the security-relevant side effect.

Audit directions

The forward-facing pattern is a more-trusted process accepting a Mach port handed up from a sandboxed one. Narrow: audit the other WebProcessProxy message handlers that receive port rights or send rights from WebContent, checking what the receiving side assumes about the port's type and what it does if the assumption is wrong. Wider: enforcement decisions that consume self-reported values from a sandboxed process are the broader class — enumerate the remaining inputs to process-termination, jetsam and throttling policy and ask which are measured by the UIProcess and which are asserted by the renderer. Widest: any privilege-asymmetric measurement where the measured party supplies the measurement has this shape; the durable fix is for the trusted side to obtain a handle and measure directly, which is what the task_name_port transfer accomplishes here. Code-review tell: an IPC message whose parameter is a port or handle type rather than a value type, arriving at a process that outranks the sender.

---