Require ORICD for group membership

### User story:
As a publisher I want to require that all users of Hypothesis have their ability to write annotations in a group restricted by their ORCID authentication, so that I can control who can create annotations on my site.

NOTE: Your user account has to be authenticated against ORCID in order for you to annotate in this group. It is a one time authorization model.

Acceptance criteria:
- Groups can require that users must be authenticated into ORCID to annotate in the group.
- For users in a group who have not authenticated against ORCID, annotation interface indicates that this is required and provides a link to do so.
- From their profile, users can connect to ORCID, and once connected, can see that status reflected (in their profile, etc).
- The existing ORCID number field in the user profile will then be populated by this authentication vs by the user typing it in directly. (What do we do about existing ORCID values?)
- A small ORCID icon shows next to the username throughout the interface*.

Q: Can users decouple the authentication later? Or change it?

*Not a necessary requirement
Partners waiting on this:
bioRxiv
ESSOAr
Wiley

Create a mechanism for us to verify someone has an ORCID account
Create a group configuration that requires ORCID as a trust provider

Start by reviewing the acceptance criteria and the open questions about ORCID connection, existing ORCID values, and decoupling. Identify the product and implementation entry points for group trust-provider configuration, profile authentication, annotation access, and interface status; done means the listed ORCID restrictions and connection flows are implemented and verified.

Written by the indexing model from the issue text.