tools: Only allow the absolute difference in bracket pairs to be less than 128, since we need the sign.

server: Setting a security descriptor should not replace an existing owner or group with a default, if only a DACL is being set.

comctl32: The RECT in the custom draw structure should be the entire item's size. This includes any separated dropdown arrow.

It made it seem as though the wineloader always started at address 0.
Issue identified by Jacek Caban.

The SetPalette check is outside of ddraw_surface_set_palette to make
sure the palettes are properly freed when a lost P8 surface is destroyed.

wininet: Fixed InternetSetCookieExW return type and forward InternetSetCookieW to InternetSetCookieExW instead of the other way around.