Use specific Sentry DSN for the client part of H

Fix CSP violation on new homepage

Since we are not allowing inline styles with our CSP policy.

rearranging annotation icons

* Rearrange the annotation action icon positions.
* Add new colours for annotation action button labels.
* Replace icons for reply, edit, delete and share.
* Update style for loggedout users too.
* Update share icon in top-bar.

Support filtering test suites to run using '--grep' argument to gulp

Remove user status bitfield

Display message if a direct-linked annotation is not available

The image is specified using the `background-image` property since that
makes it easy to use the same relative URL when the app is served from
the extension and when it is served from the site.

If an annotation is selected but was not successfully loaded,
display a message in the sidebar indicating that the user does
not have permission to see that annotation.

Add support for filtering the tests that are run by Gulp test tasks
using '--grep <pattern>'.

This avoids the need to use the `(describe|it).only` test modifiers to
filter the tests that are run.

The pattern argument is a JS regex expression which is passed directly
to mocha as the 'grep' option.

eg. To start the app test suite in auto-restart mode, but only run tests
for the markdown editor, run:

  gulp test-watch-app --grep markdown

Replace '@p <ident>' with `ident` in JSDoc comments

Using '@p <ident>' to refer to parameters in JSDoc comments is not legal
syntax. Use Markdown backticks instead, ala. Angular's docs.

Switch to appropriate group and scroll to direct linked annotation when sidebar loads

Use more Pythonic way for the argument default value

Refactor feature caching

Change icon size in the bucket bar

Also avoid using `@p` to refer to parameter names in function
documentation, since this isn't valid JSDoc syntax. Use markdown
backticks instead, following conventions in Angular's docs.

The sidebar supports multiple client pages connecting to it
and displaying annotations for all of the connected clients.
As far as I am aware, this functionality is not actually used
anywhere, but this commit fixes an issue where annotations
would be loaded multiple times for some clients if multiple
clients connected.

This was duplicated with varying levels of explanation in several
places.

Although the function is trivial, having it in its own module is useful
for documentation on why it should be used by default.

When the selection is initialized as a result of following
a direct link to an annotation, focus and scroll to the annotation
after it has been successfully fetched from the service.

When the sidebar loads as a result of an '#annotations'
fragment, we do not know which group that annotation is in.

Handle this by first fetching annotations in all groups,
then finding the group containing the selected annotation(s)
and finally filtering the results by that group.

An alternative approach would be to first fetch the
selected annotations in order to determine the group and
then fetching annotations in that group.

This approach however avoids an extra round-trip to the server
in the common case where the total number of annotations across
all groups is less than the default chunk size (200).

widget-controller.js triggers a reload of annotations whenever a
GROUP_FOCUSED event is emitted. Avoid reloading annotations
unnecessarily if group.focus() is called with the currently focused
group.

Extract the logic for paging through search results from
the API into a separate module.

Fix list/quote toolbar command when selection is empty and cursor is at start of line

Improve behavior when the user clicks the toolbar buttons to create a
list or quote and the cursor is positioned at the start of the line with
no selection. In this case, after the command is applied, the cursor
should be positioned ready for the user to start typing the quote or
list.

When the selection is empty and text is inserted at the cursor position,
it is ambiguous whether the selection is 'before' or 'after' the
replaced text. The fix here is to treat the selection as being 'before'
the replaced text.

Fixes #3091

Refactor feature flag to access through Client + caching

Sheetaluk/new sharer

New share dialog enables sharing an annotation on various social media
and a copyable link
https://trello.com/c/9lieEMfd/290-as-a-user-i-can-share-direct-links-to-annotations-with-my-world

* Hide new sharer behind the direct_linking flag
* Update google plus icon

Architecture decision records!

(1/3) Open sidebar and set selection when '#annotations' URL fragment is present

When the sidebar loads in a page with a '#annotations'
URL fragment, the 'annotations' setting will be
passed through to the client as `settings.annotations`.

Use this to initialize the selection so that
the annotation specified by '#annotations:<ID>' is
selected when the client loads.

If the host page's URL contains a '#annotations:' fragment,
open the sidebar automatically when the client loads.

 * Move code for reading Hypothesis configuration from
   the environment into config.js and add tests

 * Read the '#annotations' fragment from the URL and
   pass it to app.html along with any other options
   as query string parameters.

Postgres read support for storage.expand_uri

Enable Chrome extension to detect when H is already present on page

This reworks the way that Hypothesis detects whether it is
already present on the page in embed.js, in a way that
enables it to report back the app.html URL for the
existing instance to the Chrome extension.

The Chrome extension can then update its state for that
tab to reflect the fact that it is not injected.

In this PR, that is done by simply setting the tab state
to inactive. We could in future add an indicator that
the user tried to activate H but that another instance
is already active, or have the extension override the
instance of H on the page.

 * Detect the <link> element added to the page by embed.js,
   rather than window.annotator. This enables detection to work
   when embed.js is run in an isolated world that shares the DOM
   but not the JS environment, as is the case for content scripts
   in Chrome and Firefox.

 * Change unloading to operate by firing an event at the <link>
   element. This enables a content script to trigger unloading
   of H from an isolated JS environment.

 * Change injection of embed.js in the Chrome extension to
   execute embed.js as a content script, rather than by
   adding it as a `<script>` tag. This enables embed.js to
   access extension APIs and also report its result back
   to the extension via the return value of the script.

   A side benefit is that it also avoids a bug in Firefox
   current WebExtensions implementation where `<script>` tags
   added to the page by a content script are not executed.

Simplify API authentication in the client and fix #3083, #2924

Merge pull request #3078 from hypothesis/sheetaluk/281-update-the-toolbar-s-note-icon-tooltip-and-update-the-adder-design

changing adder icons and note icon in toolbar.