s3-lsa: use LSA_POLICY_MODE flags in _lsa_GetSystemAccessAccount().