advapi32: Use a duplicate of the process token if a NULL token is passed into CheckTokenMembership and there is no thread token.