Update permissions plugin

Now allows permissions rules to be provided in the
beforeAnnotationCreated hook.
Default all replies to Public

This fixes the annoying issue with replies defaulting to private
all the time.
Merge pull request #1584 from hypothesis/public-replies

Make replies public by default