(PUP-1987) Deny ACL should inherit by default

When setting deny with inheritance there is a bug in Puppet that doesn't use
the proper Windows library call to set access denied ACEs with the ability to set
inheritance and propagation flags. The fix for Puppet will go into 3.6.0 as
part of https://tickets.puppetlabs.com/browse/PUP-2100. This provides those
same fixes as a backport so ACL module can take advantage of the functionality
prior to Puppet 3.6.0.