s4:dsdb/tests/sec_descriptor: verify the nTSecurityDescriptor and sd_flags interaction