s3-lsa: support secret objects in _lsa_QuerySecurity().