Move the restricted_acl flag into winsecur.c.

It's silly to set it at each call site of restrict_process_acl() if
that function returns success! More sensible to have it be a flag in
the same source file as restrict_process_acl(), set as an automatic
_side effect_ of success.

I've renamed the variable itself, and the global name 'restricted_acl'
is now a query function that asks winsecur.c whether that operation
has been (successfully) performed.

windows/winplink.c

@@ -404,7 +404,7 @@ int main(int argc, char **argv)
             return 1;
     }
 
-    if (restricted_acl) {
+    if (restricted_acl()) {
         lp_eventlog(console_cli_logpolicy,
                     "Running with restricted process ACL");
     }