Fix permissions in bulk annotation script (rebased onto develop)



This is the same as gh-2420 but rebased onto develop.

----

See https://trac.openmicroscopy.org.uk/ome/ticket/12210

It looks like the OriginalFile is being created in the user's *default* group but the update of the AnnotationLink is explicitly using the group of the target Plate or Screen. For a simple user with one group this is fine, for other group combinations the link may fail or may be across groups.

This commit fixes the problem but it may not be the right fix or the right way to do this and so this PR is for comments /cc @joshmoore @pwalczysko

Testing is tricky. You need a user who has several groups, one read-only and one read-write at least. A Plate should be imported into the read-only group as per https://www.openmicroscopy.org/private/ome-internal/testing_scenarios/BulkAnnotations.html  That scenario should complete without a SecurityViolation exception.