dsdb-descriptor: Spell out security descriptor flags as constants