shell/window-tracker: Tighten sandbox ID prefix check
Since commit b6083693 we only allow WM_CLASS matches for sandboxed applications if the found app's ID is prefixed by the sandbox ID.
The existing check still has a hole in it though: "org.example.Foo" and "org.example.FooDevel" are different applications, yet the former is a prefix of the latter.
So tighten the check by including a trailing "." in the checked prefix; this excludes cases like the above, while still working for the regular case of a single .desktop file because our app IDs include the ".desktop" suffix.
Spotted by wjt.