windows: open process tokens with duplicate access
windows: open process tokens with duplicate access

A usual thing to ask is, "Is my current token in group X?" The right way
of doing such a thing is:

	processToken, err := windows.OpenCurrentProcessToken()
	if err != nil {
		return false, err
	}
	defer processToken.Close()
	var checkableToken windows.Token
	err = windows.DuplicateTokenEx(token, windows.TOKEN_QUERY | windows.TOKEN_IMPERSONATE, nil, windows.SecurityIdentification, windows.TokenImpersonation, &checkableToken)
	if err != nil {
		return false, err
	}
	defer checkableToken.Close()
	isMember, err := checkableToken.IsMember(someSID)
	return isMember && err == nil, nil

This is the same flow that's used by, for example, shell32's internal
_LUAIsTokenAdmin function.

However, this all fails unless the original token is opened with
duplicate access. So this commit adjusts OpenCurrentProcessToken to do
the right thing.

Change-Id: I18efdfde43097ea9d10758018b0df132fba819f5
Reviewed-on: https://go-review.googlesource.com/c/sys/+/192337
Run-TryBot: Jason A. Donenfeld <e7e312fea4c2c1aad2bb075d739111890e1ce08b@zx2c4.com>
TryBot-Result: Gobot Gobot <66cb808b70d30c07676d5e946fee83fd561249e5@golang.org>
Reviewed-by: Simon Rozman <088e16a1019277b15d58faf0541e11910eb756f6@rozman.si>
Reviewed-by: Alex Brainman <54ba58c8441b5eff861de6b4e5ee46baf086b142@gmail.com>

golang/sys,multiplay/golang-sys,multiplay/golang-sys,multiplay/golang-sys,multiplay/golang-sys,golang/sys,golang/sys