Avoid mach lookups of container manager service before load starts in the WebContent process. When the WebContent process is trying to find the top privately controlled domain, the CFNetwork function called will cause mach lookups of the container manager service. This is avoided in this patch by fixing an error where the url instead of the host is used to get the top privately domain. Additionally, this patch redefines when the WebContent process is regarded as launched, by setting the sandbox state variable when the load is committed. Both of these changes will move us closer to blocking launchd.