s4:dsdb/descriptor: always use descriptor_search_callback if we return nTSecurityDesc...