Since commit b6083693 we only allow WM_CLASS matches for sandboxed
applications if the found app's ID is prefixed by the sandbox ID.

The existing check still has a hole in it though: "org.example.Foo"
and "org.example.FooDevel" are different applications, yet the former
is a prefix of the latter.

So tighten the check by including a trailing "." in the checked prefix;
this excludes cases like the above, while still working for the regular
case of a single .desktop file because our app IDs include the ".desktop"
suffix.

Spotted by wjt.

!1357