(#22064) Lock down facts.d folder without resorting to custom actions

In a previous commit (e3f60524e), we tried to use WiX custom actions to
translate well-known security IDs, e.g. WIX_ACCOUNT_ADMINISTRATORS, to
localized names, e.g. Administrators, since that is what the MSI
LockPermissions table expects[1]. However, this was causing the Puppet
installer to create access control entries for the facts.d directory such
that only the builtin domain (S-1-5-32) SID could read and execute. While
this is a valid SID, it's nonsensical as it doesn't correspond to an actual
user or group account. As a result, interactive puppet runs did not work
since access to the facts.d directory was denied for all but LocalSystem.

That code was reverted in e3f60524e.

This commit changes the wix file to use the common user names "Everyone" and
"Administrators" which according to the docs, "are mapped to well-known
SIDs."

Also, we don't explicitly grant LocalSystem full control, because
"LocalSystem is given full control in all security descriptors created
through the LockPermissions Table."

[1] http://msdn.microsoft.com/en-us/library/windows/desktop/aa369774(v=vs.85).aspx