s3:services_db: extract core of svcctl_set_secdesc to _internal version