Apologies for the slight back and forth, but I now think this is a
better way to make clear to flexelint that we either keep an allocated
acl_e or not.

This partly undoes changes from bf854df6

To review, I recommend diff'ing to a3664ead

Ref aff516b7
    f65f7148