(Maint) Eliminate Windows network lookups

When using a UNC style file path, the windows file provider invokes
File.expand_path('//server/...'), which results in a failed Windows
network lookup. Executing these two tests was previously taking 15.4
seconds.

This commit instead provides a `localhost` server to short-circuit the
lookup. The tests now only take 1.7 seconds.
(#11563) Model Windows security descriptors

Creates objects for modeling windows security descriptors, access control
lists, and access control entries.
(#11563) Refactor DACL parsing

This commit moves the parsing of the DACL into a separate method,
so that it is not coupled with the loading of the DACL.
(#11563) Only rewrite the DACL if the mode changes

Previously, the owner, group, mode getter and setter methods each managed their
part of the security descriptor. This lead to similar, but slightly different
methods, such as GetSecurityInfo being invoked once to get the owner, and
another time to get the dacl.

This commits adds methods for getting and setting the security descriptor,
and updates the owner/group/mode methods to call it. This eliminated duplicate
logic many places, e.g. change_sid, get_sid, set_acl, get_dacl, get_dacl_ptr,
get_security_info, and set_security_info.

This commit also means that if you change the owner and/or group, but not mode,
then the security descriptor will not be marked as protected, and the DACL
will not be rewritten. In other words, puppet won't mess up your file
permissions.

Only if you choose to manage the mode will puppet mark the SD as protected and
rewrite the DACL based on the security descriptors owner/group and specified
mode.
(#11563) Preserve deny ACEs

Previously, puppet would warn if it encountered a deny ACE, and ignore it.
This is a problem now, because we need to be able to accurately round-trip
an ACL when modifying the owner/group.

This commit modifies the DACL parsing code to return the deny ACE in the
returned ACE.
(#11563) Return INHERIT_ONLY_ACEs

Previously, when reading a DACL, puppet excluded `INHERIT_ONLY_ACE`s which are
ACEs set on a directory that only serve to apply permissions to child
containers (dir) and objects (file). In other words, the ACE didn't affect the
permissions of the directory, and wasn't needed to determine the file mode.

However, now we need to be able to roundtrip a security descriptor, e.g. to
only change the owner, but leave other ACEs intact.

This commit modifies puppet to include inherit only aces when reading the
DACL, but continue to exclude them when determining the file mode.
(Maint) Change usages of `and` to `&&`, and `or` to `||`

The operators `and`, `or` have a lower precedence than `&&`,
`||`. This can lead to unexpected results in certain cases. While this
commit is not subject to one of those cases, the change is still made
for consistency sake.
(#11563) Cleanup tests

Cleanup spec test. Use the Everyone sid constants, remove unused
reference to INHERITED_ACE constant, and more robustly assert the
desired outcomes when "preserving aces for other users" and when
"changing the sid for all aces that were assigned to the old
owner".
(#11563) Fix issues when running as SYSTEM

Previously, the tests were failing when running as SYSTEM, because
many of the preconditions were no longer true, as a result of
puppet no longer breaking inheritance when only the owner and mode
are changed, and ensuring the SYSTEM ace grants full control,
unless explicitly specified otherwise.

This commit updates the tests to account for the new behavior.