vfs_acl_common: Do not fetch the underlying NT ACL unless we need it