s4:rpc_server/lsa: normalize the access_mask for lsa account objects