EZP-23037: remove extension of Subtree criterion
EZP-23037: join only for PermissionSubtree once only if needed