Add packaged DLP broker and protected Windows service foundation

scripts/install/windows-security.nsh

@@ -0,0 +1,14 @@
+; Called after resources are copied into the protected per-machine location.
+; nsExec hides the console and bounds captured output by NSIS_MAX_STRLEN.
+; Its timeout is an inactivity timeout; the trusted Python helper also owns
+; a hard wall-clock deadline and kill-on-close Job for its grant descendants.
+!macro customInstall
+  nsExec::ExecToStack /TIMEOUT=245000 '"$INSTDIR\resources\python\python.exe" -I -B "$INSTDIR\resources\inspector\provision_runtime_acl.py" --provision'
+  Pop $0
+  Pop $1
+  StrCpy $1 ""
+  StrCmp $0 "0" safetynet_runtime_acl_ready
+  SetErrorLevel 1
+  Abort "SafetyNet could not establish the required scanner security permissions. Installation stopped."
+  safetynet_runtime_acl_ready:
+!macroend