OAK-51 : Access Control Management (wip)

Effective policies:
- avoid reading effective policies from transient state -> fix TODO and add more tests

Restrictions:
- allow restriction properties to have a mv value
- add node type restriction to validate multi-restriction behavior
- add composite restriction pattern to evaluate multiple restrictions present with a ace

git-svn-id: https://svn.apache.org/repos/asf/jackrabbit/oak/trunk@1481736 13f79535-47bb-0310-9956-ffa450edef68