Enable admins to activate users

Add an "Activate" button next to users on the /admin/users page so that
admins can activate user accounts.

Some refactoring to avoid code duplication between activating by users
clicking on an activation link and admins clicking the new activate button:
move the code that actually activates the user onto the User model where
both views can call it.

Packaging cleanups

Convert <markdown> component to JS and add basic tests

This commit moves a couple of helper tasks for developing the frontend
into the gulpfile, and also improves the automatic installation of
dependencies and building of assets.

All that is now required to get a running development server (with built
frontend assets) from a fresh checkout of the repository is:

    make dev

Subsequent runs of `make dev` will ensure the JavaScript and Python
dependencies are up-to-date but will not rebuild the assets unless they
are either explicitly cleaned,

    make clean dev

or the developer runs the gulp `watch` task independently (recommended).

Similarly, from a fresh checkout, it should be possible to run the test
suite simply by running:

    make test

Note that this commit removes `gulp-cli` and `karma-cli` from the
package dependencies -- these packages are not intended to be installed
in a software distribution, although they can both be installed globally
to assist with easier dispatch of gulp/karma tasks if needed:

    npm install -g gulp-cli karma-cli

Fix tags autocomplete dropdown CSS

Speed up npm dependency checking when running 'make dev'

When package.json changes, use 'check-dependencies' to do
a lightweight offline-only check of whether the installed
packages match the versions specified in package.json
before running the much slower 'npm install' to actually
install any missing dependencies.

7fff01e changed the annotation cards from <article> to <annotation>.
This seems to break the CSS of the tags autocomplete dropdown
(particularly: the width is too short) unless the <annotation> has
display: block;

Fixes #3007.

Ensure request session is correctly committed in non-web contexts

Fix docker build

A couple of related improvements to how we build the Dockerfile:

1. Don't invalidate the Python dependencies layer just because
   `package.json`, `gulpfile.js` or `scripts/` changed.
2. Use a prebuilt node-sass binary. The prebuilt binaries supplied by
   the node-sass project aren't compatible with Alpine Linux (which uses
   musl-libc rather than glibc).
3. Make some small tweaks to the gulpfile so we can build just the
   assets needed for the web application (i.e. skipping the extension).

This code is in pretty poor shape. Some lint violations
were easily fixed, others will require larger refactoring
of the code. Before that can be done the existing behavior
needs test coverage. For the moment this commit suppresses
the lint violations.

As an initial step towards cleaning up the annotation
editor component, convert it to JS and add basic tests.

The conversion was automated using
[decaffeinate](https://github.com/decaffeinate/decaffeinate)
with a small amount of subsequent cleanup.

The tests are very basic at the moment and cover
just the read-only/editing states and rendering
of markdown and LaTeX

Remove angular-animate dependency

This reduces the Angular bundle size by about 30KB.

There are no references to ng-{enter, leave, move} or
the other hooks that I could find.

angular-animate was added in fdf132efe7d56de34633451c159b05460769a259
but the mentioned CSS classes no longer exist.

Add "bouncer" support to Chrome extension

Postgres documents

Streamer work queue

Remove unnecessary dependency on YAML

Fix form button background gradient

Remove unused '...' which were originally variable
arguments to the compass 'linear-gradient()' mixin.

Now we are just using the linear-gradient() CSS function
however so the '...' was never expanded, resulting in
invalid CSS.

New front-end build system based on Gulp

 - Correct the image reference to be valid with the new build
   system, where styles are served at /assets/styles and
   images under /assets/images.

 - Use @include rather than @extend per current CSS
   conventions for H

This check is already performed in scripts/polyfills.js

This fixes an issue where duplicate sourcemaps were
created for modules which had Browserify shims applied to them such
as annotator.js and annotator.document.js. The duplicated
sourcemaps were not stripped from the bundle by exorcist,
resulting in a much larger production build than necessary.

Some development dependencies were listed in 'dependencies'
and others were listed in 'devDependencies'.

This makes package.json consistent by listing everything
that is either required to build the client
in 'dependencies' and everything else in 'devDependencies'.

This also removes several unused dependencies.

The change in e5bf6d1e to use the same Promise polyfill
in the tests as in the app exposed a test which tried
to call a missing stub (flash.error).

The error previously went unnoticed because it was reported
via an unhandled Promise rejection. The core-js Promise polyfill
however has a last-resort handler for uncaught promises so
the error showed up.

 * Modify Dockerfile to use Gulp build command to
   build client assets.

 * Add 'git' dependency required for installation of
   node-sass npm dependency.

Using an external reference to h.woff rather than an inline font
enables the font to load when served by the Chrome extension
on sites that have a strict Content Security Policy, such as
GitHub.

Regarding the removed comment about URL rewriting, the
new Gulp-based build system currently doesn't do any
URL rewriting but we do know that styles
will be served at /(assets|public)/styles/<bundle name>.css
and fonts at /(assets|public)/fonts/<name>.woff , so
we can just use a URL relative to the CSS file path.

Fixes #2266

After replacing the asset build pipeline with Gulp, webassets'
only function was to generate URLs for files defined in
named bundles and add cache-busting query strings.

It wasn't doing the latter because webassets does not
generate cache-busting query strings for files it serves
unless at least one filter is used or an output path is defined.

This commit replaces webassets with a Pyramid static view
and a small custom asset config environment, h.assets.Environment.

h.assets.Environment reads a set of named bundles defined
in the h/assets.yaml config file and a JSON manifest which maps
file paths to URLs with cache-busting query strings, generated
by the Gulp build process.

In the process, the logic for adding CORS headers to static
asset requests has been rewritten to 1) Explain _why_
a CORS header is needed and 2) Add the headers in a way
that doesn't rely on internal details of how Pyramid works.

pyramid.static.static_view is used directly rather than
config.add_static_view() because add_static_view() does
not provide a way to decorate requests in order to add
the CORS header.

See https://github.com/Pylons/pyramid/issues/1486

The URL polyfill is only required if window.URL lacks
a constructor.

'js-polyfills/url' does have its own feature detection but
relies on 'URL' being available at 'this.URL' which works
when loaded independently but not when included as a CommonJS
dependency.

Adding our own feature test here should make it easier to
avoid loading the polyfill entirely in future on browsers
that support the URL constructor.

Piping CSS files through autoprefixer
is now handled in gulpfile.js

As per the comment in karma-phantom-polyfills.js, it is
preferable that the tests use only a minimal set
of polyfills which match those used in the app.

Since we now have a script which requires all of the polyfills
used in the app for IE 10/11, we can just include that
in karma-phantomjs-polyfill.js.

This also removes the need to keep two separate Promise polyfill
packages.