MODE-2210 Enforce ACL checks in Session.getNodeByIdentifier and Session.getNodeByUUID.

Previously these methods were simply just looking up the nodes and not enforcing ACLs.
This change corrects that oversight, and ensures that only nodes for which the session
has read privilege (via normal permissions or ACLs) will be returned.

Because the path is not known at first, this change also refactors the session's
methods to check the permissions to no longer require a Path instance to be determined
prior to calling these methods. Instead, a `PathSupplier` can be provided when the path
is not yet known, and the supplier implementation should determine the path if needed.
This is important, because the path is not needed for normal role-based permissions checking
and is needed only when ACLs or custom authorization providers are used.