Do not treat adminCount as proof of current AdminSDHolder protection

[ndemou]

Problem

HealthTest-AdminSDHolderCoverage reports users with adminCount=1 as users currently protected by AdminSDHolder.

File: health-tests/HealthTest-AdminSDHolderCoverage.ps1, lines 12-13.

The adminCount value can remain set after an account is removed from a protected group. It is not reliable proof of current protected-group membership.

Simple example

A user was once a Domain Admin and later removed. The account still has adminCount=1. The test reports that AdminSDHolder protection is currently applied to that user even though the user is no longer protected by group membership.

Expected behavior

Use current membership in the protected groups, including nested membership, for current coverage. If stale adminCount values are useful, report them separately as cleanup candidates.

Acceptance criteria

• A stale adminCount=1 account is not described as currently protected.
• Current nested protected-group members are recognized.
• Stale markers can be reported separately.
• Unit tests cover current, nested, and formerly protected users.