dsdb-samldb: Only allow known and settable userAccountControl bits to be set