vfs_zfsacl: only grant DELETE_CHILD if ACL tag is special