win32_capture: correctly handle unspecified security IDs in MFT