Add a SessionConstraints class to gui.

This is intended to hold the on/off states of
various constraints, allow registering new
ones, and provide subscription to a constraint's
state.
Disallow deleting others' annotations by default.

This introduces SessionConstraints into SessionController
and AnnotationController. The latter comes with a new
permission, namely "edit.annotations.allowNonAuthorDelete".

Code is added into AnnotationController to check
for the author name of the annotation node to be deleted,
and do nothing if it matches the name of the current
user.

Inside EditorSession which instantiates the SessionConstraints
instance, "edit.annotations.allowNonAuthorDelete" is disabled
to achieve the desired result.
Introduce "Review Mode".

Let DirectFormattingController obey this constraint
by not creating any operations or processing any action
to format text when the cursor is not within the local
user's annotation.

Signals are exposed to toolbar widgets so they may
enable/disable themselves on the fly depending on the cursor
context.
Add a new gui.SessionContextCache convenience class.

It lazily computes required information and caches it
for further use -- an initial method inside it is
isLocalCursorWithinOwnAnnotation, which contains the logic
moved from DirectFormattingController. It would have been
expensive to perform this check separately everytime the
cursor moves in each controller.
Make hyperlink editing respect review mode constraints.
Move image insertion code from EditorSession to ImageInserter.

This allows access to controllers directly in the widget, as is
the convention.
Make image insertion respect review mode constraints.
Make text editing respect review mode constraints.
Add review editor to programs/editor