Fix permissions in bulk annotation script (rebased onto develop)


This is the same as gh-2420 but rebased onto develop.

----

See https://trac.openmicroscopy.org.uk/ome/ticket/12210

It looks like the OriginalFile is being created in the user's *default* group but the update of the AnnotationLink is explicitly using the group of the target Plate or Screen. For a simple user with one group this is fine, for other group combinations the link may fail or may be across groups.

Testing is tricky. You need a user who has several groups, one read-only and one read-write at least. A Plate should be imported into the read-only group as per https://www.openmicroscopy.org/private/ome-internal/testing_scenarios/BulkAnnotations.html  That scenario should complete without a SecurityViolation exception.