Replace Perl admof with a C version that is six times faster, and correctly handles negative ACLs and cross-realm principals.