Is there any way to associate an ACL with a specific alternate data
stream in a file or must all streams inherit the ACL of the container
file?

msdn states that each stream has its own allocation size, actual size,
and valid data length and also maintains its own state for
compression, encryption, and sparseness.

It also explicitly states that no file times are associated with
streams, but it makes no specific mention of other data (e.g. readonly
or hidden attributes, ACLs, etc.)

My guess is the answer is 'no' because the stream-specific attributes
all seem to pertain to the actual state of the stream content vs. what
would truly be considered metadata, but is the behavior for this other
data specifically documented anywhere?