v0.1.3.1

test(scm): assert DACL rights by membership; drop ConvertTo-SecureString

- Windows normalizes SDDL on read-back: the delegated RPWPLC came back
  as LCRPWP (bits reordered) and GA expanded to the concrete service
  rights, so substring assertions can never match. Parse the ACE
  (type;flags;rights;o;i;sid) and assert rights membership; a plain
  unit test pins the parser against the verbatim read-back string.
- Build the throwaway-account SecureString via [SecureString]::new() +
  AppendChar instead of ConvertTo-SecureString: its module
  (Microsoft.PowerShell.Security) fails to auto-load on some machines
  (CouldNotAutoloadMatchingModule) while LocalAccounts loads fine;
  ::new()/AppendChar are CLR/language features with no cmdlet
  dependency.