s4:dsdb/acl: calculate the correct access_mask when modifying nTSecurityDescriptor