(#15563) Only modify the DACL when managing the mode

Previously, if the owner and/or group were managed, but the mode wasn't, the windows DACL, could remove access control entries that it shouldn't have.  Given a security descriptor of the form:

    Owner: [user]
    Group: None
    Dacl:
      SYSTEM: Full Control
      Administrators: Full Control
      [user]: Full Control

And a manifest of:

    owner => 'Administrator',
    group => 'Administrators',

where `mode` is not specified. Puppet would first sync the `owner` property. This would rewrite the DACL as:

    Dacl:
      Administrator: Full Control

In other words, only `Administrator` has any rights, and `Administrators` have none. Next puppet would sync the `group` property, resulting in the same DACL (because the old group didn't have any permissions). As a result, the `Administrators` group, which previously had `Full Control` now has none.

This commit updates the code for managing security descriptors, access control lists, and access control entries. When the owner and/group are modified, any access control entries that applied to the old owner (or group) are reassigned to the new owner (or group). All other access control entries are preserved, in their original order.

Puppet will only modify the DACL in a non-trivial way if you are managing the `mode` property.