Function default_root_sddl 

pub fn default_root_sddl(admission: &RootAdmission) -> String

The security descriptor the default runner root is created and reconciled with, in SDDL.

Split out and public for the same reason crate::secrets splits out its own: a test asserts the exact string rather than inferring it from a file, and a reviewer reads one line instead of three API calls.