s4:dsdb/descriptor: recalculate nTSecurityDescriptor after a rename (bug #8621)