Persist access and refresh tokens to localStorage.

Frame validity checks

As noted in PR feedback, the OAuth token key should be based on the
annotation service rather than just authority. The annotation service is
currently identified by (API domain, authority) but in future we'll
likely integrate the authority into the API URL for 3rd-party accounts
(eg.  "https://publisher.hypothes.is/api").

Rename for consistency with `saveToken`.

Convert search query parser to JS and add tests

Removing flags for multiple iframe support

For code in newly created JS files, arrow functions should be favored.

In the process fix an inconsistency where the "since" term was returned
as a number for hours, days, weeks, months and years but as a string for
seconds.

Convert the SearchFilter class to JS using decaffeinate and convert
methods which do not depend on any external state, which is all of them,
into plain functions.

Persist access and refresh tokens to localStorage, under the key:

  hypothesis.oauth.<authority>.token

Where `<authority>` is the domain of the annotation service and the
structure is the JSON-encoded object:

  {
    accessToken: <token>,
    refreshToken: <token>,
    expiresAt: <UNIX timestamp in ms>
  }

When an API token is requested for the first time during startup, the
existing token for the current authority is loaded from storage,
validated locally and then used if possible.

We should review whether or not to include this file in the source tree,
given that we use Yarn primarily for package management, but since it is
here, keep it up to date.

Fix adder position when document or body position is offset.

Use OAuth for first party login if enabled.

Respond to CR feedback in
https://github.com/hypothesis/client/pull/476#discussion_r126539329

Avoid mutating frames array in DESTROY_FRAME action.

Fix positioning of the adder when the document or body elements are
positioned and offset relative to their default position.

There were two problems:

 1. When converting from viewport to "document" coordinates, code in
    `adder.js` and `range-util.js` failed to account for the document
    element's position being offset from the default (0, 0) location.
 2. When setting the adder's top/left coords, `Adder#showAt`
    did not take into account the offset of the body element from the
    document.

This commit fixes the issue by:

 1. Using viewport coordinates as far as possible in the range-util and
    Adder functions to reduce the need for converting coordinates.

 2. Calculating the position of the adder by comparing the target
    viewport coordinates for the adder and the viewport coordinates of
    the adder's nearest positioned ancestor.

Fixes #487

The state is supposed to be immutable. `Array#splice` modifies its
argument. Use `Array#filter` instead which returns a new array.

Emit an event on the Guest element, ‘scrollToRange’

Follows DOM event name conventions.

If the service provides an OAuth client ID and sets the "oauthEnabled"
flag in the app configuration, use OAuth for first party login.

This initial implementation does not persist the token for future use,
so the user has to login every time they use the app.

This allows attached handlers to hook into the behaviour of bringing a highlight anchor into view.
The event.detail property contains a native DOM range representing the anchor.
The default scroll behaviour can be prevented with the event.preventDefault method.
The event bubbles upward, meaning a handler could be attached at the guest root element  - right now the document’s body element - and any ancestor.
body -> documentElement -> document -> window

The latest version makes it work for sub-document frames

Merge pull request #481 from hypothesis/dont-show-view-switcher-until-first-batch-of-annotations-received

Don't show view switcher until annotations received

Don't show the view switcher until the first batch of annotations has
been received. (This first batch will be all the annotations, unless
there are more than 200 annotations of the page.)

This is an attempt to reduce "popping" caused by the annotation switcher
suddenly changing a brief time after first render, when annotations are
loaded:

https://github.com/hypothesis/product-backlog/issues/327#issuecomment-312657968

Increase robustness of frame destruction

Find the true URI record for a Document when there’s conflicting info

The previous implementation of this used the iframe’s `src` uri as the key for identifying which frames needed to be removed from the sidebar’s frame-sync state.
We can’t rely on this uri because there could be one or more iframes sharing the same src uri, for example ‘about:blank’ with/without `srcdoc` attribute usage.
Another problem is with a `blob:` uri as the src. Once again the uri in the src can’t be used as the key since it won’t match what frame-sync thinks the proper uri is if it’s being substituted with  `baseURI`.

The way this works now is by tagging the frame info with a random ID called the frameIdentifier. The handling of this tag is coordinated with the relevant modules, cross frame, bridge, frame-sync, etc.

Modified to fit our needs of course..