Add finer control over who can see Annotations

[fm3]

add third option “private” for annotation sharing:

private (only me and my team-managers/admins)
non-public (everyone in my organization)
public (everyone, no need to log in)

(those names are of course preliminary)

this probably means replacing the isPublic flag with an Enum.

this is also the first test of how we can provide a backwards compatible api (assuming #3385 is merged first)

related: https://discuss.webknossos.org/t/cant-share-my-volume-tracing/1159/8 and corresponding issue #3347 with PR #3348

[jstriebel]

Possible Steps in the Backend:

• adapt schema (& add evolution)
• adapt code to generated (case?) classes
• adapt routes that set & read this (add as v2 in webknossos.versioned.routes)
• adapt permissions queries
• document new route versions