Refactor extract annotation query

Only match the `#annotations:<ID>` regex against the URL if the
`#annotation:<q|query>:<QUERY>` regex, which takes precedence, doesn't
find a match.

This also makes it clearer that the URL-safe base64 IDs comment applies
to `annotFragmentMatch` only not to `queryFragmentMatch`.

I think this makes the code more readable.

This both clarifies the intent of the code (what exception, thrown by
what, it's intending to catch) and reduces the chances of a bug where it
actually catches a different exception thrown by something else that it
didn't intend to catch.

Rewrite these tests to make them more descriptive, and clarify what the
behaviour of `extractAnnotationQuery()` actually is:

- Replace `unroll()` with a simple dynamic test generation approach that
  allows each test to have its own different `describe()` and `it()`
  strings

- Change the top-level describe from `describe('annotation queries'` to
  `describe('annotation.util.extractAnnotationQuery'`

- There was a test for what happens when a `#annotations:<ID>` fragment
  contains non-alphanumeric characters which used the test URL
  `'http://localhost:3000#annotations:\"TRYINGTOGETIN\");EVILSCRIPT()'),`.
  This seems to suggest that the alphanumeric characters restriction is a
  code injection defense, but I don't think it is. Replaced this with just
  `not%20alphanumeric`.

Fix extract-annotation-query.js to just export a function, instead of
exporting an object containing just a single function.

Tests and other tweaks to shared/settings.js

Add a new set of unit tests that test more cases.

Rename options to config in annotator

There are two reasons for renaming the `options` object to `config`:

**First**, it's more consistent. The file that creates this object is
called `config.js`, and the function that creates the object is called
`configFrom()`, and yet the object ends up getting called `options` (but
you have to look in another file, `main.js`, to find this out).

`config` is also used elsewhere as the name for the main configuration
object, for example in Pyramid/h, in the client docs ("Configuring the
Client", "configuration settings") and public API
(`class="js-hypothesis-config"` scripts and `window.hypothesisConfig()`
functions), etc.

These "options" that the `src/annotator/` code reads from the host page
also end up getting renamed to `hostPageConfig` when they get passed
over in to the `src/sidebar/` code.

**Second**, it's more unique. There are a number of other objects in the
`src/annotator/` code that are called options, sometimes the main
options object and another local options object are even used in the
same function. There's no other objects called config.

This makes it easier to grep for uses of this function.

Rename the `config()` function that creates the `options` object to
`configFrom()`.

This is because I want to rename the `options` object to `config` in a
future commit, so I need the `config()` function to be called something
else.

I think `configFrom(window)` is also clearer (that this is a function
that returns a `config` object created from the given window) than
`config(window)` (which could be read as configuring the window, for
example).

Improve the `src/annotator/config.js` unit tests

The main change is to make the tests much more detailed by adding more
unit tests describing and testing more of the code's behaviour. But
also:

* Remove some test fakes which implemented non-trivial fake behaviour:
  `fakeScriptConfig`, `fakeQuerySelector`, `fakeWindowBase`. Just use
  simple stubs instead.

* Make each test test just one thing (previously many of the tests for
  one part of the code could fail if another part of `config.js` was broken).

* Isolate the `config.js` unit tests from `src/shared/settings.js` and
  `extract-annotation-query.js`. Previously the `config.js` tests could
  fail if `settings.js` or `extract-annotation-query.js` were broken,
  and implementation details of `settings.js` and `extract-annotation-query.js`
  were coded into the `config.js` tests.

* Fix an issue with one test that if it failed a `window.document` would
  be left modified

A few followup fixes to "Allow publishers to customize user menu links followup"

Prevent Adder toolbar from inheriting CSS property values from host page

The adder toolbar uses Shadow DOM or `!important` to prevent CSS rules
in the host page from directly affecting the styling of the toolbar.

However even inside Shadow DOM elements can still inherit CSS property
values from parent elements [1].

This commit fixes that problem for current browsers (except Edge [2]) by
using `all: initial` on the Adder's root element.

[1] See https://github.com/w3c/webcomponents/issues/314
[2] http://caniuse.com/#feat=css-all

Fixes #382

Add config option to show highlights only when sidebar is open

Update jQuery to current version & slim build

Instead of two different js-* classes. Simplifies the JavaScript code.

According to our CSS guidelines, use js-* CSS classes as handles for
JavaScript to find HTML elements.

Allow publishers to customize log out, profile and help links

Convert the "showHighlights" option from a boolean into an enum with
three values: "always", "never" and "whenSidebarOpen". When the last
mode is selected, highlights will only be shown when the sidebar is
open.

Stubbing `getComputedStyle` in the pointer events test resulted in the
test failing after the jQuery update in the previous commit because the
`css(..)` jQ method used by that test depends on `getComputedStyle`
internally.

Use `serviceConfig()` everywhere

Update our horrifically old jQuery build which included workarounds for
browsers we no longer support to the current stable version of jQuery.

Also switch to using the slim build which excludes features we don't
use.

This reduces the size of the minified jQuery bundle from 96KB to 68KB.

Always use `serviceConfig()` instead of accessing `settings.services`
directly.