Add policy provider that would filter extensions/apps allowed on the

extensions/common/api/_behavior_features.json

Index: extensions/common/api/_behavior_features.json
diff --git a/extensions/common/api/_behavior_features.json b/extensions/common/api/_behavior_features.json
index 07fae0ebc5134dc04045a36138f371ef28311d01..49fb62603817030380de64aa2909b8acfa6057a0 100644
--- a/extensions/common/api/_behavior_features.json
+++ b/extensions/common/api/_behavior_features.json
@@ -41,5 +41,23 @@
     "whitelist": [
       "CBCC42ABED43A4B58FE3810E62AFFA010EB0349F"   // https://crbug.com/538252
     ]
-  }
+  },
+  "signin_screen": [{
+    "blacklist": [
+      "9E527CDA9D7C50844E8A5DB964A54A640AE48F98"   // Chrome remote desktop
+    ],
+    "channel": "dev",
+    "extension_types": ["platform_app"],
+    "location": "policy",
+    "min_manifest_version": 2
+  }, {
+    "channel": "stable",
+    "platforms": ["chromeos"],

[emaxx, 2016/09/05 13:58:20]

Shouldn't this go into the first "branch" of the signin_screen feature too? I
think here it only applies to the whitelisted extensions.

[Denis Kuznetsov (DE-MUC), 2016/10/31 18:26:51]

Done.

+    "whitelist": [

[emaxx, 2016/09/05 13:58:20]

Shouldn't also the "component_extensions_auto_granted":false property be
specified, if the intention is to disallow some of the component extensions?

[Denis Kuznetsov (DE-MUC), 2016/10/31 18:26:51]

Done.

+      "E24F1786D842E91E74C27929B0B3715A4689A473",  // Gnubby component extension.
+      "6F9E349A0561C78A0D3F41496FE521C5151C7F71",  // Gnubby app

[emaxx, 2016/09/05 13:58:21]

I think I may already asked this in one of the previous iterations, but is
Gnubby app really useful on the login screen? Isn't it that only the Gnubby
extension is necessary for performing the authentication?

+      "8EBDF73405D0B84CEABB8C7513C9B9FA9F1DC2CE",  // Genius app (help)
+      "3F50C3A83839D9C76334BCE81CDEC06174F266AF"   // Virtual Keyboard
+    ]
+  }]
 }