Update test and development dependencies to latest versions from npm,
except for PhantomJS. The PhantomJS 1.9.x -> 2.x transition requires
additional changes in tests.

A couple of issues came up during the upgrade:

 - 'constructor' is no longer a valid name for describe() blocks

 - The require() in Karma's Browserify config ended up being resolved
   relative to the location of karma.config.js for reasons I haven't
   debugged, instead of looking in node_modules/. Using
   require.resolve() to get the absolute path works around the issue.

Return all canonical uris when expanding a canonical uri

[Update annotations in Pg 1/3]: Fix reply template for postgres

* Changes to html.

Clear pending timeouts when AppController is destroyed

Fix a flaky AppController test and potential causes of flakyness or
runtime errors in other tests due to timeouts set up in directives or
controllers firing after the associated scope is destroyed.

Add a helper which sets a timeout that is cleared automatically
when an associated scope is destroyed.

In the AppController test this manifested itself with a timeout
being called when `$document[0]` was not set.

Fix Hypothesis on local HTML documents

Markdown rendering refactor and math sanitization fixes

Fix an off-by-one error in PDF anchoring code

KaTeX escapes its own input and we trust it to generate safe HTML as
output. Passing HTML generated by KaTeX through ngSanitize can mangle
the result.  eg. The formatting of the infinity symbol is corrupted when
using this test block for example:

  $$\lim_{x \to \infty} \exp(-x) = 0$$

This commit rewrites the rendering logic to only sanitize the markdown
output from Showdown.

This additionally fixes an issue where text that _happened_ to also
be valid markdown in the rendered math would be rendered as markdown,
which is not what we want.

Create a single instance on the first call and cache it afterwards.

 - Add a test that input markdown is sanitized with ngSanitize

 - Add a test that verifies that malformed HTML is tolerated.

Angular 1.5.x no longer throws an exception when the input HTML is
malformed. This adds a test to catch any potential changes in future and
document the expected behavior.

Fixes #2970
Fixes #2935

Make it easier to verify that rendered content is sanitized correctly by
feeding the final HTML string to $sanitize once, instead of trying to
sanitize pieces individually.

In the process, this fixes a bug with the previous implementation where
inline math was rendered if it started or ended with either '\(' or
'\)'. The new implementation requires that inline math blocks start with
only '\(' and must have a matching '\)'

This logic has now been moved to render-markdown.js

Extract markdown and math rendering out of the editor
component into a separate module and add tests.

The PDF anchoring code systematically failed to anchor annotations made
at the very start of a PDF page, due to an off-by-one error in
determining the page associated with a given text offset.

Fixes #2418.

The only thing stopping Hypothesis from working on local (i.e. file://
URL) HTML documents is the failure of the discovery module due to quirks
in the `postMessage` security policy.

This commit works around that issue so that embedding or injecting
Hypothesis on local HTML documents works as expected.

Fixes #2005.

CSP Violation: old homepage

Changes the space between items in the group members list. Reduces the space between documents a little, to make them a bit more balanced.

Dev install docs corrections

Scroll share dialog into view when created

These dialogs appear at the top of the annotation list, scroll
them into view if necessary.

The 'scroll-into-view' library is used rather than
Element.scrollIntoView() in order to get smooth animations that are
consistent with how the document is scrolled to selected annotations.

 - Only write to the dialog visibility state in one place
   in AppController.

 - Scroll share and login dialogs into view when corresponding
   link is selected in top bar.

Fixes #3043

Convert the dialog to JS and modernize the style to follow current
component conventions.

Remove empty annotations when a new annotation is created

When a new annotation is created, remove any empty annotation cards that
currently exist. This fixes an issue where it was easy to accidentally
create a large number of blank annotations or empty replies.

Any annotations which are not new (ie. have an ID assigned) or have tags
or text entered by the user are kept.

This logic applies to both annotations and replies.

Merge pull request #3197 from hypothesis/sheetaluk/299-add-a-copy-to-clipboard-button-to-the-share-menu

Add copy to clipboard functionality.

Add basic copy to clipboard functionality so user can use a button
click to copy a direct link to his clipboard, when supported by the
browser.

* Refactor annotation share dialog into a component.
* Add tests for annotation share dialog.

Merge pull request #3216 from hypothesis/sheetaluk/298-add-product-version-and-environment-info-to-the-tool

Show product version and environment info.

Show a dismissable card to the the top of the sidebar containing
information about the version of the tool they have installed as
well as environment information so that we have more information
while troubleshooting errors.

`legacy-site.js` is only loaded on the old home page, so we can safely
add it to that existing JS file.

It lives in it's own CSS file (`styles/old-home.css`) to make it easier
to delete once we remove the old homepage.

Add a helper function for writing parameterized JS tests

 Fix error in session.js when an /app request fails 

Retry requests to /api endpoint