fix(safeio): use self-relative create descriptors

tools/tht/internal/safeio/private_windows.go

@@ -279,7 +279,12 @@ func newOwnerOnlySecurityDescriptor() (*ownerOnlySecurityDescriptor, error) {
 		owner.Close()
 		return nil, ErrUnsafeFile
 	}
-	return &ownerOnlySecurityDescriptor{ownerOnlyDACL: owner, descriptor: descriptor}, nil
+	selfRelative, err := descriptor.ToSelfRelative()
+	if err != nil || selfRelative == nil || !selfRelative.IsValid() {
+		owner.Close()
+		return nil, ErrUnsafeFile
+	}
+	return &ownerOnlySecurityDescriptor{ownerOnlyDACL: owner, descriptor: selfRelative}, nil
 }
 
 func (descriptor *ownerOnlySecurityDescriptor) Close() {