gh-134587: Suggest fix for tempfile.mkdtemp() in Windows AppContainer

[vedant713]

---

Proposed Solution

• Detect whether the process is running inside an AppContainer.
• Retrieve the AppContainer SID using whoami /user.
• Use icacls to grant Full Control access to that SID for the created directory.

---

Suggested Helper Functions

if _os.name == 'nt':
    import ctypes as _ctypes
    import ctypes.wintypes as _wintypes
    import subprocess as _subprocess

    def _is_appcontainer():
        TOKEN_QUERY = 0x0008
        TokenIsAppContainer = 29
        h_token = _wintypes.HANDLE()
        if not _ctypes.windll.advapi32.OpenProcessToken(
            _ctypes.windll.kernel32.GetCurrentProcess(),
            TOKEN_QUERY,
            _ctypes.byref(h_token)
        ):
            return False

        is_container = _wintypes.BOOL()
        return_length = _wintypes.DWORD()
        if not _ctypes.windll.advapi32.GetTokenInformation(
            h_token,
            TokenIsAppContainer,
            _ctypes.byref(is_container),
            _ctypes.sizeof(is_container),
            _ctypes.byref(return_length)
        ):
            return False

        return bool(is_container.value)

    def _grant_appcontainer_access(path):
        try:
            sid = _subprocess.check_output("whoami /user", shell=True)
            sid_str = sid.decode().splitlines()[1].split()[1]
            _subprocess.run(f'icacls \"{path}\" /grant *{sid_str}:(OI)(CI)F', shell=True, check=True)
        except Exception:
            pass

• Issue: mkdtemp() created directories no longer allows for writing files when running under a Windows AppContainer in 3.12.4 (but works under 3.12.3) #134587