`h` Group Model's `flag` permission should be assigned to real users only

I was doing a little research for https://github.com/hypothesis/product-backlog/issues/829 about how flagging works vis-a-vis moderation, and realized that flags are a relationship between users and annotation (not just a flag per annotation, say).

Right now, the Group Model's ACL logic will assign the `flag` permission to the `security.Authenticated` principal if the group is world-readable (and `h.traversal.contexts.AnnotationContext` will pick that permission up and assign it to the current request if the annotation in question is shared—you can't flag a private annotation).

In our current AuthPolicy setup, that's OK, because this endpoint does not allow AuthClient authentication. But if it _did_, there is a possibility we could have an authn'd request without an authn'd _user_.

Thus, to be more watertight for the future, this permission should be assigned to `h.roles.User` not `security.Authenticated`. Minor change; shouldn't be time-consuming.

Start by locating the Group Model's ACL logic and h.traversal.contexts.AnnotationContext, which the issue identifies as the relevant entry points. Trace how the flag permission is assigned for world-readable groups and picked up for shared annotations. Done means only h.roles.User receives this permission, rather than security.Authenticated; no test file is mentioned in the issue.

Written by the indexing model from the issue text.