s3:client: avoid cli_errstr() where we already have an NTSTATUS