Extend Document#canonical to include annotations_url endpoint

If document's status is PRE/POST moderate or an account that has
permissions is present, include an annotations_url endpoint on the
document's canonical representation.

Right now it's defaulting to an agnostic protocol (no http or https specified), but
may need to be forced to use https in future