Introduce interface to extract tree from users

while working on OAK-9803 it struck me that there are several places in the oak security code base where a tree object needs to be retrieved from a given user/group, which according to the API contract only has a getPath() method returning a JCR path.

Since the default implementation is backed by a tree object, it would in certain cases (same content session being used to retrieve the User and the Root) be possible (and likely better from a performance point of view) if there was an option to access the tree instead of traversing the hierarchy again to build it from the path.

cc: joerghoh, fyi