s3: vfs_fruit: Ensure we operate on a copy of the incoming security descriptor.