Support authorization restriction based on mixin types

Currently there is only the restriction nt:Names which just considers primary (non-effective) node types (https://jackrabbit.apache.org/oak/docs/security/authorization/restriction.html#built-in-restrictions). In addition it should be supported to restrict access based on the mixin types.

The use case is e.g. Sling i18n dictionaries which leverage the mixin mix:language (https://sling.apache.org/documentation/bundles/internationalization-support-i18n.html#jcr-repository-based-resourcebundleprovider).