Support physically nested access needs and grants

[justinwb]

Access needs and data grants only support requesting and granting access to a given data registration at the top level of the registered shape tree. However, there are cases where an application should only require access to a subset of that shape tree. Access needs (and subsequent data grants) should have the ability to perform this specific targeting.