r4388: - allow ACE flags to be specified in security_descriptor_create()