Re-use this utility to translate offsets between the original page text
and the whitespace-stripped version of the page text. This allows the
`stripSpaces` helper to be simplified and avoids creating some offset
arrays that are unused.

These arose from resolving confusion during a verbal code review.

Expand on the choice of "input" and "output" as names for the two string
arguments. These could equally have been "source" and "destination" or
"stringA" and "stringB".

When anchoring a quote in a PDF, the quote is first searched in text
extracted using PDF.js's `PDFPage.getTextContent` API, and the resulting
positions are used to create a range within the hidden text layer of a
page.

An issue we've seen several times when doing PDF.js upgrades is minor
changes to which spaces are included in the text layer. In the past
we've adapted our text extraction to match the text layer each time.
This slows down the process of upgrading PDF.js and makes maintaining
compatibility with a range of PDF.js releases more difficult. In the
most recent update, an `includeMarkedContent` option was added to the
`getTextContent` API, and the presence of that option could affect
whether certain whitespaces are included in the output nor not [1].

Try to address this issue generally by mapping offsets from the page
text into offsets in the text layer in a way that ignores whitespace
differences.

 - Add `translateOffsets` utility, which maps a (start, end) pair
   of offsets in an input string into corresponding offsets in an output
   string, where the output is a version of the input that has been
   "corrupted" by the addition or removal of certain characters (eg.
   whitespace)

 - Use `translateOffsets` utility in PDF anchoring to map quote offsets
   in the page text returned by `PDFPage.getTextContent` into offsets in
   the `textContent` of the text layer element.

[1] https://github.com/hypothesis/browser-extension/pull/799#issuecomment-1079864595

Remove "is" from some state-related reference names.

This separates out the component styling from the contextual/positioning
styling.

Fade the Spinner in slowly on annotation-save such that it only appears
if saving the annotation is taking a while. This reduces visual clutter
when the annotation saves quickly.

Fix height-jumping issue with saving message in Annotation

Bumps [minimist](https://github.com/substack/minimist) from 1.2.5 to 1.2.6.
- [Release notes](https://github.com/substack/minimist/releases)
- [Commits](https://github.com/substack/minimist/compare/1.2.5...1.2.6)

---
updated-dependencies:
- dependency-name: minimist
  dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.1101.0 to 2.1106.0.
- [Release notes](https://github.com/aws/aws-sdk-js/releases)
- [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js/compare/v2.1101.0...v2.1106.0)

---
updated-dependencies:
- dependency-name: aws-sdk
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@sentry/browser](https://github.com/getsentry/sentry-javascript) from 6.19.2 to 6.19.3.
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/master/CHANGELOG.md)
- [Commits](https://github.com/getsentry/sentry-javascript/compare/6.19.2...6.19.3)

---
updated-dependencies:
- dependency-name: "@sentry/browser"
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [preact](https://github.com/preactjs/preact) from 10.6.6 to 10.7.0.
- [Release notes](https://github.com/preactjs/preact/releases)
- [Commits](https://github.com/preactjs/preact/compare/10.6.6...10.7.0)

---
updated-dependencies:
- dependency-name: preact
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@sentry/cli](https://github.com/getsentry/sentry-cli) from 1.74.2 to 1.74.3.
- [Release notes](https://github.com/getsentry/sentry-cli/releases)
- [Changelog](https://github.com/getsentry/sentry-cli/blob/master/CHANGELOG.md)
- [Commits](https://github.com/getsentry/sentry-cli/compare/1.74.2...1.74.3)

---
updated-dependencies:
- dependency-name: "@sentry/cli"
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [eslint-plugin-react-hooks](https://github.com/facebook/react/tree/HEAD/packages/eslint-plugin-react-hooks) from 4.3.0 to 4.4.0.
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/packages/eslint-plugin-react-hooks/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/HEAD/packages/eslint-plugin-react-hooks)

---
updated-dependencies:
- dependency-name: eslint-plugin-react-hooks
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@types/katex](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/katex) from 0.11.1 to 0.14.0.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/katex)

---
updated-dependencies:
- dependency-name: "@types/katex"
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [prettier](https://github.com/prettier/prettier) from 2.6.1 to 2.6.2.
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/2.6.1...2.6.2)

---
updated-dependencies:
- dependency-name: prettier
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [sass](https://github.com/sass/dart-sass) from 1.49.9 to 1.49.11.
- [Release notes](https://github.com/sass/dart-sass/releases)
- [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sass/dart-sass/compare/1.49.9...1.49.11)

---
updated-dependencies:
- dependency-name: sass
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [puppeteer](https://github.com/puppeteer/puppeteer) from 13.5.1 to 13.5.2.
- [Release notes](https://github.com/puppeteer/puppeteer/releases)
- [Changelog](https://github.com/puppeteer/puppeteer/blob/main/CHANGELOG.md)
- [Commits](https://github.com/puppeteer/puppeteer/compare/v13.5.1...v13.5.2)

---
updated-dependencies:
- dependency-name: puppeteer
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Add a test case for pages served with the `Cross-Origin-Opener-Policy:
same-origin` header, which currently breaks the client's login popup.

This reproduces the issue from https://github.com/hypothesis/product-backlog/issues/1333.

Add support for specifying custom headers to serve test pages with via
inline `<!-- Header: <Key>:<Value> -->` comments in the HTML/XML, and
change the existing XHTML test case to use it.

The process of creating and navigating the login popup used to involve two
steps, first creating a blank window and then navigating it to the final
authorization URL. This was needed because, in Firefox, the popup window had to
be created in the same turn of the event loop as the user's click on the "Log
in" button (otherwise the popup blocker would trigger) but generating the
authorization URL involved an async "fetch" of API links.

The major browsers have now all settled on a more flexible model for allowing
popups in response to user gestures, where the popup must be opened within a
certain time window of the gesture. In practice the timeout seems to be ~1000ms
in Safari and longer than that in other browsers.

In this context we expect the async delay between the user clicking the "Log in"
button and us creating the popup to be ~0ms, since the API links should already
have been fetched at this point and so we're just fetching locally cached values.

Based on this assumption, the flow for creating the login popup window has been
simplified to create the popup window at the final URL immediately, removing the
need to open a blank window as a first step.

Simplifying the code here will make it easier to change how the popup window and
sidebar communicate, eg. to resolve an issue with the new
Cross-Origin-Opener-Policy header [1].

[1] https://github.com/hypothesis/product-backlog/issues/1333

 - Add state and action types to reducers

 - Replace Array.forEach calls with for..of loops to enable better type
   inference.

 - Replace plain objects used as sets with ES sets

Avoid the need to manually create the `SidebarStore` type by inferring
it automatically. This works as follows:

 1. The `modules` argument to `createStore` has been converted to a
    tuple type (`[ModuleA, ModuleB, ...]`)
 2. The type of a module that would result from merging all the
    individual modules (`ModuleA & ModuleB ...`) is computed
    using a `TupleToIntersection` utility type
 3. `StoreFromModule` is used to compute the type of the store that the
    merged module would produce

Extract a StyledText component that can be used by MarkdownView and
AnnotationQuote. Update some props on Markdown components to match
conventions.

Add new service to notify ancestor frame on annotation activity, if
so configured.

Previously, this component was _styled_ as a "panel", via SASS mixins,
but did not have any behavioral "panel-ness."

For now, use the shared Card (presentational) component for this
 component, and remove unused SASS and mixins.

Listen for key events for keyboard shortcuts on the document element rather than
body element, to make them work in XHTML documents.

When no interactive element (eg. an input field) is focused in an HTML document,
keyboard events are sent to the body element. In an XHTML document however
keyboard events are sent to the document element instead in Safari and Chrome
(in Firefox they are still sent to the body). The key event listeners used for
the adder's shortcuts were installed on the body element, so they didn't work in
XHTML documents in Safari and Chrome.

My guess is that the reason for this behavioral quirk is that HTML documents are
guaranteed to have a body element - an empty one will be generated if none
is present in the markup, whereas XHTML documents are not.

Fixes https://github.com/hypothesis/client/issues/4364