Major Description
The jcr specification defines jcr:nodeTypeManagement privilege for all
JCR API calls that set jcr:primaryType and jcr:mixinType properties.
however, on the oak level we lack the ability to distinguish between
system internal and user supplied modification of those properties.
possible solution:
- introduce ability to distinguish between API call and system internal mod
- only enforce permission in oak-jcr (backwards compatibility issue as it
used to be checked upon save only) - violate spec and drop explicit check for jcr:nodeTypeManagement for those
cases where it's ambiguous in order not to have existing code failing.