dsdb-acl: introduce a 'el' helper variable to acl_modify()