This reverts commit dbd76575.

According to MSDN, ppSecurityDescriptor must not be NULL if any of the
SID or ACL parameters are non-NULL.  This is wrong, and native
GetSecurityInfo will happily return those pointers, leaving one unable
to free the original security descriptor.