samr: don't block the sam sid or the builtin domain sid in sid_to_name