Restore permissions checkboxes; remove plugin

This commit restores the last important functionality of the Permissions
plugin, namely the ability to set permissions directly on the
annotations using fields in the Editor. As such, it removes the
Permissions plugin.

Here is a short summary of where the functionality of the Permissions
plugin has gone:

- The abstract authorization API has become the authorizer interface and
  corresponding registry entry.
- The default implementation has moved to Authorizer.Default.
- The decision about whether to display the edit and delete buttons in
  the Viewer is delegated to 'permitEdit' and 'permitDelete' functions,
  which are passed in as options to the viewer. Both the Viewer plugin
  and DefaultUI hook these up to the registry authorizer by default.
- The "allow all to {view,edit}" checkboxes have moved into the
  DefaultUI plugin.

Backwards incompatible change: a missing or empty field in permissions
now implies anyone can perform the action, whereas the empty array
implies no-one can. This is a reversal of the previous interpretation,
and (IMO) a much less surprising behaviour.
Should use strict equality when possible (perhaps we can add a style rule for this?). Or if you're comfortable with it `u == null` has the same outcome as the above statement.