provision: Make dsacl2fsacl() take a security.dom_sid, not str