Instead of duplicating the token and masquerade it as if the token was filtered (which is a big hack), properly implement CreateRestrictedToken function by calling NtFilterToken which it'll create a restricted token for us.
This is wrong and messes up with internal structures (such as TEB).
For the two needed functions which are "NT6+", they were exported
with NT6, but already existed in W2K3 SP2.
This might fix random bugs
CORE-15526
Import the following Wine commits:
* 79636bebbfa Michael Müller: advapi32: Set last error to ERROR_SUCCESS in GetSidIdentifierAuthority.
* 1d03ba76116 Hans Leidekker: advapi32: Fix parsing empty DACL/SACL security descriptor strings.
* 5bc2e83c7ab Hans Leidekker: advapi32: Fix size returned from ConvertStringSecurityDescriptorToSecurityDescriptor on 64-bit.
