(#17031) Use SIDs to modify ADSI group membership

 - New methods add_member_sid and remove_member_sid do the heavy
   lifting inside of Puppet::Util::ADSI::User to add / remove group
   members instead of relying on string names.
 - Expose a new sid method on Puppet::Util::ADSI::User that exposes
   a Win32::Security::SID instance with account, domain, and raw SID
 - Puppet::Util::ADSI::User#uri instance method now uses the sid
   account and domain to build a URI
 - Since uri now relies on the sid method, which converts the binary
   objectSID byte array of the native_user, the native_user is
   initially loaded by generating a throwaway uri based off of parsing
   the name given to the initializer.  This is done to prevent a
   circular reference.  This effectively means the original given name
   is not perfectly round-tripped, but that's OK because the underlying
   SID is used for the sake of comparison and group modification.
 - Due to dependence on Windows::Security, some tests are now run only
   on Windows.  This was a trade off where it would have been possible
   to add an initializer param for @sid to Puppet::Util::ADSI::User, but
   it seemed cleaner to not do that.