s4:dsdb/descriptor: make explicit that we don't support MOD_DELETE on nTSecurityDescr...