(PUP-2100) Use AddAccessDeniedAceEx for inheritance

With Access Control Entries (ACEs) on Windows, we currently use AddAccessDeniedAce
which does not include inheritance and propagation, but AddAccessDeniedAceEx does.
We are already using AddAccessAllowedAceEx when setting access allowed ACEs and
we should use the same behavior for denied ACEs. This commit provides that ability.
Without this commit we will not be able to properly manage access denied
ACEs with inheritance to child objects.