Bump angular-mocks from 1.7.7 to 1.7.8

Bumps [angular-mocks](https://github.com/angular/angular.js) from 1.7.7 to 1.7.8.
- [Release notes](https://github.com/angular/angular.js/releases)
- [Changelog](https://github.com/angular/angular.js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/angular/angular.js/compare/v1.7.7...v1.7.8)
Signed-off-by: dependabot[bot] <support@dependabot.com>

Add Currently Viewing, Featured, & My Groups sections to group drop down

Replace $http with fetch in api service

 - Use `null` to indicate requests that fail in `expectCall` rather than
   0/-1.
 - Use 200 as the response from `POST /api/annotations` in tests to
   match the real response code from h.

* Add Currently Viewing, Featured Groups and My Groups sections
* Remove leave group icon
* Remove view group page link as there is no room for it in the UI
and
user’s are often clicking it accidentally.

* Remove ability to select groups that are not scoped to the page.


Simplify selector list items
Add active styles for toggle and list items
Only apply active background to group selector toggle
Refine dropdown toggle styles

This was missed in 11ac0e25.

`fetch` may reject if executing the request fails, eg. due to a
network-level error. Make sure that `store.apiRequestFinished` is called
in this case and modify an existing test to simulate this behavior
correctly.

Also make some minor comment improvements.

This header allows the h web service to associate API requests with
WebSocket clients, and thus avoid sending clients notifications about
their own actions.

This used to be set as a global header on all requests made with the
`$http` service. Re-implement this header but only for API requests.

Modify the Hypothesis API client to use `fetch` instead of $http.

There is one change to the interface of the "api" service which is that
failures no longer set a `response` property on the `Error` instance.
This functionality was not being used elsewhere in the client.

Move API activity state to store

Replace $http with fetch in api-routes service

Call `store.apiRequestStarted` and `store.apiRequestFinished` methods
when API requests start and finish. This causes the loading spinner to
correctly indicate whether API requests are in progress.

Reflect the loading state of the app reported by `store.isLoading()` in
the bar at the top of the UI, instead of querying
`$http.pendingRequests`.

This is part of the migration the Hypothesis API client away from
AngularJS's $http to `fetch`.

As part of the move away from AngularJS, we need to replace the current
logic in the `<search-input>` component for determining whether any
activity is happening in the app that should result in a loading
indicator being shown.

This commit adds a module to the store that holds activity-related state
which can be used when rendering the UI.

As part of the migration away from AngularJS, replace use of the `$http`
service with `fetch` when fetching API route information from the `/api/`
route.

This is part of #974.

Replace $http with fetch in OAuthClient

Fix Google Analytics event reporting

Fix a race condition where events would not be reported if the analytics
service was instantiated before Google Analytics had fully loaded.

The main interface to Google Analytics, `window.ga`, is initially a
simple function which just records commands in a buffer. When
analytics.js loads it sends the buffered events and replaces `window.ga`
with a function that sends new events immediately. The analytics service
captured the value of `window.ga` at the time it was instantiated and did
not use the replacement after GA loaded. As a result tracked events were
just stored in a buffer and never send to GA.

Fix this by removing the `GoogleAnalytics` wrapper class and always invoking
the _current_ `window.ga` function.

Also update the documentation of the service's methods and add pointers to
relevant Google Analytics docs.

Fixes #976

Remove angulartics dependency

Replace angular-sanitize with DOMPurify

Bump eslint from 5.15.0 to 5.15.1

Bump autoprefixer from 9.4.9 to 9.4.10

Bump @octokit/rest from 16.16.3 to 16.17.0

Bumps [autoprefixer](https://github.com/postcss/autoprefixer) from 9.4.9 to 9.4.10.
- [Release notes](https://github.com/postcss/autoprefixer/releases)
- [Changelog](https://github.com/postcss/autoprefixer/blob/master/CHANGELOG.md)
- [Commits](https://github.com/postcss/autoprefixer/compare/9.4.9...9.4.10)
Signed-off-by: dependabot[bot] <support@dependabot.com>

Bumps [eslint](https://github.com/eslint/eslint) from 5.15.0 to 5.15.1.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/master/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v5.15.0...v5.15.1)
Signed-off-by: dependabot[bot] <support@dependabot.com>

Bumps [@octokit/rest](https://github.com/octokit/rest.js) from 16.16.3 to 16.17.0.
- [Release notes](https://github.com/octokit/rest.js/releases)
- [Commits](https://github.com/octokit/rest.js/compare/v16.16.3...v16.17.0)
Signed-off-by: dependabot[bot] <support@dependabot.com>

Add show section logic

As part of the migration away from AngularJS, replace `$http` with
`fetch` in the OAuthClient class which handles interactions with h's
OAuth endpoints.

For testing use the fetch-mock library that is already used in h's
frontend tests. The current version (v7) has dependencies that are
written in ES6 and not transpiled, and so don't work in PhantomJS [1]. As a
workaround, use v6 of the library for the time being.

This is part of #974.

[1] We _do_ transpile our own code from ES6 -> ES5 but that transform is
    not applied to dependencies.

Also improve the documentation on how to add a new polyfill in future.

As part of the migration away from AngularJS, replace Angulartics with
direct usage of the Google Analytics client.

Since we only use a single analytics provider (Google Analytics) and
only basic event tracking functionality in a single-route application,
its easiest just to replace the code with direct calls to the
analytics.js API.

See https://developers.google.com/analytics/devguides/collection/analyticsjs/events

Fixes #976

In preparation for the move away from AngularJS, replace
angular-sanitize with the DOMPurify library, which is a modern and
widely used HTML sanitization library with no framework dependency.

The sanitization logic is now encapsulated fully within the
`render-markdown` module which no longer takes a sanitization function
as an argument. That argument used to be necessary because
the angular-sanitize function had to be obtained via Angular's
dependency injection. DOMPurify can just be required as a module inside
render-markdown.js.

One improvement that is possible with DOMPurify but not done here is to
generate sanitized DOM nodes directly instead of having showdown
generate HTML, which is then parsed to DOM and sanitized, then converted
back to HTML and finally converted back to DOM by Angular.

Fixes #975