s4:dsdb/dirsync: explicitly ask for sdctr->secinfo_flags = 0xF