Windows: Police the DEBUG TRACE ioctls

When we get a IOCTL_AFS_GET_TRACE_BUFFER, a IOCTL_AFS_CONFIGURE_DEBUG_TRACE
or a IOCTL_AFS_FORCE_CRASH, we check to see whether the caller is in the
Administrators group and if it isn't we fail the request with ACCESS_DENIED.

NOTE that this does not check whether the user has done the "run as admin"
thing.  We actually need to determine which priviledges are appropriate to
this action and use that rather than group membership to police these actions
and this will be added in a later patch.  Meanwhile this represents a
significant increment in security from previously.

Reviewed-on: http://gerrit.openafs.org/8843
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Jeffrey Altman <jaltman@your-file-system.com>
Tested-by: Jeffrey Altman <jaltman@your-file-system.com>
(cherry picked from commit dd672fffe9bfef6bd872b008e7f3e3dd5f904a80)

Change-Id: I3566649677e2a0962167f3a7d0fb2b8b201b5c7d
Reviewed-on: http://gerrit.openafs.org/8934
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Jeffrey Altman <jaltman@your-file-system.com>
Windows: Police Library IOCTLs

Ensure that the callers of the various library ioctls have
the correct identity or privs.  All this policing is done in
the fs (non unloadable) layer, and to ensure that the library
layer cannot receive these calls directly we forbid non
create Opens of the library control device.

Reviewed-on: http://gerrit.openafs.org/8893
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Tested-by: Jeffrey Altman <jaltman@your-file-system.com>
Reviewed-by: Jeffrey Altman <jaltman@your-file-system.com>
(cherry picked from commit 4da5f0b498782094b979737f6bee6e0bd2f5cb79)

Change-Id: Ic23830ed30468e2b2f8c8125ce175daa589b6b93
Reviewed-on: http://gerrit.openafs.org/8935
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Jeffrey Altman <jaltman@your-file-system.com>