s4-dsdb: when the SD_FLAGS control is set, don't remove nTSecurityDescriptor