Skip over CAs that can't be resolved to SIDs during collection

[definitelynotagoblin]

Description

If ResolveHostToSid doesn't return a valid SID when processing a CA, we don't want to collect it.
Currently ResolveHostToSid from SHCommon falls back onto a hostname from DNS when a SID can't be determined. For now we wish to leave that behavior as is.

Motivation and Context

https://specterops.atlassian.net/browse/BP-508

How Has This Been Tested?

Screenshots (if appropriate):

Types of changes

• Chore (a change that does not modify the application functionality)
• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• Documentation updates are needed, and have been made accordingly.
• I have added and/or updated tests to cover my changes.
• All new and existing tests passed.
• My changes include a database migration.

[StephenHinck]

Will this fix it for all scenarios where ResolveHostToSid is used? I believe this also affects some delegation paths as well today.