Support for hierarchical domain constraint with *automatic read* access on parent nodes

With the hierarchical domain rule support added, it is still cumbersome to add some hierarchical rule below some node, because still read access to the parent nodes must be given.

If we can add this to a domain (rule) it would make configuration much easier