Make RightToSDDL reverse map deterministic for colliding mask values (#81)

[p0dalirius]

Linked Issue

Closes #81

Motivation

RightToSDDL was built in init() by ranging over SDDLToRight and assigning RightToSDDL[right] = sddl. Two distinct tokens map to the same mask — "KR" (KEY_READ) and "KX" (KEY_EXECUTE) are both 0x00020019 — so the surviving token for that value depended on Go's randomized map-iteration order and changed between runs. Any consumer rendering a mask back to an SDDL token got an unstable, sometimes-wrong abbreviation.

What Changed

• init() now collects the SDDLToRight tokens, sorts them, and inserts into RightToSDDL keeping the first (lexicographically smallest) token for each mask. For the colliding value this deterministically yields "KR" (since "KR" < "KX").
• Added sort import.

Design Notes

Lexicographic first-wins is a deterministic, documented tie-break that requires no second source of truth to maintain. "KR" is the natural canonical token for 0x00020019 (KEY_READ is the conventional rendering of that mask). The forward SDDLToRight map is unchanged, so both "KR" and "KX" still parse to 0x00020019.

Acceptance Criteria Check

• RightToSDDL[0x00020019] returns the same token on every run — TestRightToSDDL_CollisionDeterministic asserts it is "KR"; the sorted-iteration construction makes it run-independent.
• A test asserts the chosen token for the colliding value and that all other entries round-trip — TestRightToSDDL_CollisionDeterministic and TestRightToSDDL_IsValidInverse (every reverse entry maps back to its mask, and every forward mask is representable).
• No change to SDDLToRight parsing behavior — the forward map is untouched.

How Verified

• Tests: sddl/rights/rights_test.go — TestRightToSDDL_CollisionDeterministic, TestRightToSDDL_IsValidInverse.
• go build ./... and go test ./... pass.

Test Coverage

• Added: the two tests above (first tests in the sddl/rights package).

Scope of Change

• Files changed: sddl/rights/rights.go, sddl/rights/rights_test.go
• Submodule pointer updated: no
• Public API changes: none; RightToSDDL lookups become deterministic
• Behavioral changes outside the stated enhancement: none

Risk and Rollout

Trivial and local; only the previously-random winner for colliding masks is now fixed. Safe to merge.