advapi32: Allow GetFileSecurityA/W to work on files that have been opened already with restricted sharing flags.

Only use the minimum required access rights for the information being retrieved.

server: Use ACL_REVISION in create_default_dacl instead of MAX_ACL_REVISION since we don't use any features from later ACL revisions.

Use it to implement NtQuerySecurityObject.

These both don't operate on tokens so token.c is not the right place for 
them to be implemented.

gdi32: Only cache the glyph metrics when rendering to a monochrome bitmap or when just retrieving the metrics.