Users can create nodes in workspaces they can't publish

[bwaidelich]

When newNodeType is configured, the "new node"-Button is active whether the current user is allowed to create nodes in the currently selected workspace or not.

Example:

When a user with the role Neos.Neos:RestrictedEditor (ie. without Neos.Neos:Backend.PublishToLiveWorkspace privilege) selects the live workspace as target (eg. accidentally) a padlock appears and all (inline & inspector) editors turn into read only mode. But the "new node"-Button in the FlatNav is still active:

The user can even create nodes (which IMO is a bug of Neos really)