(Maint) Eliminate Windows network lookups

When using a UNC style file path, the windows file provider invokes
File.expand_path('//server/...'), which results in a failed Windows
network lookup. Executing these two tests was previously taking 15.4
seconds.

This commit instead provides a `localhost` server to short-circuit the
lookup. The tests now only take 1.7 seconds.
(#11563) Model Windows security descriptors

Creates objects for modeling windows security descriptors, access control
lists, and access control entries.
(#11563) Refactor DACL parsing

This commit moves the parsing of the DACL into a separate method,
so that it is not coupled with the loading of the DACL.
(#11563) Only rewrite the DACL if the mode changes

Previously, the owner, group, mode getter and setter methods each managed their
part of the security descriptor. This lead to similar, but slightly different
methods, such as GetSecurityInfo being invoked once to get the owner, and
another time to get the dacl.

This commits adds methods for getting and setting the security descriptor,
and updates the owner/group/mode methods to call it. This eliminated duplicate
logic many places, e.g. change_sid, get_sid, set_acl, get_dacl, get_dacl_ptr,
get_security_info, and set_security_info.

This commit also means that if you change the owner and/or group, but not mode,
then the security descriptor will not be marked as protected, and the DACL
will not be rewritten. In other words, puppet won't mess up your file
permissions.

Only if you choose to manage the mode will puppet mark the SD as protected and
rewrite the DACL based on the security descriptors owner/group and specified
mode.
(#11563) Preserve deny ACEs

Previously, puppet would warn if it encountered a deny ACE, and ignore it.
This is a problem now, because we need to be able to accurately round-trip
an ACL when modifying the owner/group.

This commit modifies the DACL parsing code to return the deny ACE in the
returned ACE.
(#11563) Return INHERIT_ONLY_ACEs

Previously, when reading a DACL, puppet excluded `INHERIT_ONLY_ACE`s which are
ACEs set on a directory that only serve to apply permissions to child
containers (dir) and objects (file). In other words, the ACE didn't affect the
permissions of the directory, and wasn't needed to determine the file mode.

However, now we need to be able to roundtrip a security descriptor, e.g. to
only change the owner, but leave other ACEs intact.

This commit modifies puppet to include inherit only aces when reading the
DACL, but continue to exclude them when determining the file mode.
(Maint) Change usages of `and` to `&&`, and `or` to `||`

The operators `and`, `or` have a lower precedence than `&&`,
`||`. This can lead to unexpected results in certain cases. While this
commit is not subject to one of those cases, the change is still made
for consistency sake.
(#11563) Cleanup tests

Cleanup spec test. Use the Everyone sid constants, remove unused
reference to INHERITED_ACE constant, and more robustly assert the
desired outcomes when "preserving aces for other users" and when
"changing the sid for all aces that were assigned to the old
owner".
(#11563) Fix issues when running as SYSTEM

Previously, the tests were failing when running as SYSTEM, because
many of the preconditions were no longer true, as a result of
puppet no longer breaking inheritance when only the owner and mode
are changed, and ensuring the SYSTEM ace grants full control,
unless explicitly specified otherwise.

This commit updates the tests to account for the new behavior.
(#11563) Implement pending tests for when permissions are insync

When permissions are insync, i.e. puppet is actively managing the
owner, group, and mode, then we ensure that an explicit SYSTEM ace has
been added. When source_permissions is set to ignore, we ensure that
an inherited SYSTEM ace has been added.
(#11563) Output human readable security descriptor

Overrides `inspect` methods to return human readable sid and flags.
(#11563) Create an explicit ace if the old ace is inherited

Given a directory owned by Administrators and group None, and with DACL:

    NT AUTHORITY\SYSTEM:(I)(OI)(CI)               0x1f01ff
    BUILTIN\Administrators:(I)(OI)(CI)            0x1f01ff
    WIN-QP47VOHA2P4\albert:(I)(OI)(CI)            0x1f01ff

where the ACE for the owner is inherited (I). If puppet changed the owner to
Users, it would copy all of the inherited ACEs as-is. But the new owner
would not have any privileges, even though the old owner did. The same is
true for group.

This commit ensures that if we see an inherited ACE for the old owner, that
we prepend a new explicit ACE, whose type (allow or deny), flags and mask
grant/deny the same access as the inherited ACE did.

Note that not all flags are valid when setting an ACE, e.g. INHERITED_ACE is
only something you can read, not set.

As a result of this change, when puppet changes the owner from Administrators
to Users the dacl will have the following ACE prepended to the list, with
the existing inherited ACEs copied as-is:

    BUILTIN\Users:(OI)(CI)                        0x1f01ff

Note that the new ACE has the same mask as the old one, and has the object
and container inherit flags set.
Merge remote-tracking branch 'joshcooper/ticket/master/11563-owner-group-mode-are-interdependent'

* joshcooper/ticket/master/11563-owner-group-mode-are-interdependent:
  (#11563) Create an explicit ace if the old ace is inherited
  (#11563) Output human readable security descriptor
  (#11563) Implement pending tests for when permissions are insync
  (#11563) Fix issues when running as SYSTEM
  (#11563) Cleanup tests
  (Maint) Change usages of `and` to `&&`, and `or` to `||`
  (#11563) Return INHERIT_ONLY_ACEs
  (#11563) Preserve deny ACEs
  (#11563) Only rewrite the DACL if the mode changes
  (#11563) Refactor DACL parsing
  (#11563) Model Windows security descriptors
  (Maint) Eliminate Windows network lookups