Don't use -1 to mean "forever" in lockoutpolicy and passwordpolicy tests

[chisholm]

The relevant API uses DWORDs to represent many account policy related configuration options. The real system values should be used in items, not -1, which is an illegal value for a DWORD. See NetUserModalsGet().

We think -1 was originally used because the macro "TIMEQ_FOREVER" is defined in a system header as "((unsigned long) -1L)". -1 occurs as an implementation detail of the macro definition. Tests should not be defined in terms of these sorts of implementation details.