s4-schema: fixed the SDDL for the schema root security descriptor