When creating a window station with CreateWindowStationW, the function ignores the security descriptor provided by the caller and instead it uses whatever descriptor the system can find.
Observed via API monitoring.
This corresponds to the case where Win32k creates a window station whose name is based on the logon session identifier for the calling process.
Add also a note about the fact that we need to use a per-session-based WindowStation directory name, as done already in Win32k.
CORE-11933 and PR #621.
Also, improve NtUserSetWindowStationUser() capture order, make psid optional as it should (and avoid a user-mode triggered BSOD), and initialize luidUser only when everything succeeded.
