Require permission specifications on all parameters

[mcoblenz]

Right now, reference-type parameters with no permission annotation default to Unowned. But it's hard to remember that this is the case. We should consider requiring annotations on all parameters. We should also consider always requiring a this parameter, since the default (Unowned now) is rarely right.