Fix permission validation in internal extension API

[cd-work]

Currently in our own extension API, we validate permissions by checking for an exact match. However for path permissions this is incorrect, since these permissions should be validated by checking if the path to be validated is a child of the permitted paths.