server: A new function "set_sd_defaults_from_token" that sets the security descriptor along with a token that will be used to gather defaults, instead of always using the primary token.

Some objects take their defaults not from a primary token but from a different one (such as from the impersonation token or the process token).
This function can be used to create the various set_sd implementations
for the objects that need it.
As a bonus, a NULL token will skip setting any defaults, this is useful for object implementations that would like to set their defaults _only_ upon creation.
server: Support sending process and thread security descriptors for the "new_process" request in the protocol.
server: implement passing a process security descriptor to CreateProcess.

For now the function "NTDLL_create_struct_sd" has been duplicated in kernel32. This is needed because kernel32 makes the server call.
Kernel32 currently makes the server call because NtCreateProcess(Ex) has not been implemented in ntdll. When NtCreateProcessEx (and NtCreateThreadEx) gets implemented,
the server call will be made from within ntdll instead, and this extra function in kernel32 will no longer be needed.
server: implement passing a thread security descriptor to CreateProcess