Runtime Restriction of the Operational Design Domain: A Safety Concept for Automated Vehicles