As an admin, I want the SitePolicies policy to support additional site-scoped constraints, so that I can run high-risk or sensitive sites under stricter sandboxing.

Acceptance criteria:

- EphemeralStorage (boolean): Clears all site data for the matched site when the isolated site session ends. (session-end trigger is last tab for the origin closed / overlaps with SanitizeOnShutdown.)
- ContainerizedSiteData (boolean): Open matching domains in a container.
- DisableServiceWorkers (boolean): Blocks service worker registration and background sync for the matched site.
- ForceHttpsOnly (boolean): Forces HTTPS-Only behavior for the matched site, with no HTTP fallback.
- BlockLocalNetworkAccess (bool): Blocks access to localhost, private IP ranges, and intranet/local-network resources.
- Storage & Cache Partitioning: lock / prevent disabling
- Total Cookie Protection (State Partitioning): lock / prevent disabling
- Enhanced Tracking Protection – Fingerprint Blocking: lock / prevent disabling

Implementation notes:
- https://firefox-admin-docs.mozilla.org/reference/policies/sitepolicies/

Out of scope:
- New site-matching syntax; constraints reuse the existing SitePolicies site-matching mechanism.