provision: fix nTSecurityDescriptor of containers in the DnsZones (bug #9481)