Enforce policy for published nodes for read/write

This commit splits the policy checks we do on node operations into
"read" checks and "write" checks, so that we can enforce different kind
of policies based on the state of a node (i.e. published or not).