(PUP-839) FFI AddAccessAllowedAceEx

• FFI calls made to AddAccessAllowedAceEx and AddAccessDeniedAceEx and properly verify their return codes against FFI::WIN32_FALSE. Further, return nil explicitly when not raising.
• Update call site in set_security_descriptor accordingly, using and freeing a FFI::MemoryPointer for the ACL.