Ok, at least I partially discovered why hcitool requires root privileges for a LE scan but not for a normal scan. Partially means, that I located the system call which fails due to insufficient privileges when running the LE scan as a normal user.
The "Operation not permitted" error is generated by a writev system call, with the call stack locking as follows (all functions implemented in hci.c, see the bluez source code):
hci_le_set_scan_parameters -> hci_send_req -> hci_send_cmd -> writev
The normal scan ("hcitool scan") apparently does not need to send any requests to the controller, but uses a dedicated ioctl request, calling:
ioctl(dd, HCIINQUIRY, (unsigned long) buf);
It seems that write access to the bluetooth controller is restricted, but why and how can I deactivate that?