samr4: Use <SID=%s> in GetAliasMembership