Register the Annotation class with an interface
Take over the groupfinder authn callback

Horus uses 'user:<id>' as the principal name assocatied with a user.
Since we use 'acct:<username>@<provider>' everywhere else, let's use
that here to save us some converting.
Add an ACL for the Annotation resources

With this change we're pulling the annotator-store authz model into
line with pyramid.security so we can leave annotator-store (and
h.api.store by extension) well encapsulated and isolated from the
rest of the application.
Publish store events with the Annotation class
Use pyramid for store authz
Use pyramid.security to check streamer authz

Fixes #574