Skeleton joining: prevent removal of annotations without permissions

A user can only remove annotations that (s)he has permissions on, i.e. owns the
link or is part of the group of a user who owns this link. This commit ensures
that this principle is sticked to when joining skeletons. The front-end will
deactivate check-boxes for annotations that a user has no permissions on. The
back-end will forbid new annotation sets for a joined skeleton that remove
annotations that the current user has no permissions on.