fix(sessions): drop the deny-NETWORK pipe ACE (#187)

NT AUTHORITY\NETWORK marks a network logon, not a remote caller. On windev
a gateway run from an SSH session carries it in its own token, so the deny
entry locked the gateway's same-machine workers out (UnauthorizedAccess on
connect; 15 fake-worker tests failed). The ACL now holds exactly one entry:
FullControl for the gateway's user.

docs/GatewayConfiguration.md

@@ -743,8 +743,8 @@ gateway↔worker link is a per-session **named pipe**
 (`mxgw-{gatewayPid}-{sessionUid}`), not a network socket. It is not
 TLS-encrypted and does not need to be: it never leaves the local Windows host and
 is secured by the OS pipe ACL: on Windows the gateway creates each pipe with a
-protected DACL that grants only its own account (the account the worker is
-launched as) and denies network logons; on the non-Windows test matrix it uses
+protected DACL whose only entry grants its own account (the account the worker
+is launched as); on the non-Windows test matrix it uses
 `PipeOptions.CurrentUserOnly`. See `WorkerPipeSecurity` and [Worker Frame Protocol](./WorkerFrameProtocol.md).
 
 ## Related Documentation