MODE-2186 Added permissions checks for the getNodes() public methods if and only if ACLs are enabled.

To avoid these checks internally, `getNodesInternal()` methods were added which never perform permission checks. Also, added explicit validation which disallows ACLs (which are stored as children) for external nodes.