Chrome extension: update packaged PDF.js code to v1.0.907

Change highlight CSS for PDF.js

Put notifications behind a feature flag

Make the auth and settings sections of the app template into blocks so
that they can easily be overridden in inheriting templates. That makes
it possible to split the account and notifications settings into their
own templates without worrying about whether they are applicable for
downstream partners, who can now override the whole block rather than
the account template, for instance.

Pulse annotation cards when updated

Clean up the extension build script

In order to help the user notice updates arriving over the websocket,
this commit causes cards to pulse when they're updated.

If an annotation is part of a collapsed thread, then the pulse will
occur on the first visible parent thread.

Cards owned by the logged-in user will not pulse. This is primarily an
easy way of ensuring that cards don't pulse in the same view as they are
being edited (although it doesn't ensure this in all cases), but it also
makes sense more generally: users don't need to be notified of changes
they have made.

Fixes #1790.

This allows them to be included as a dependency without side effects.

Update PDF plugin

... to 46274663 (typed-packaging branch)

Un-minify dependencies

And only show the notifications panel for account settings when it is turned on

Fix #1762

Default to public visibility on annotations.

Fix #1799

development.ini: Add a development-mode session secret

Clean up Streamer.onmessage

- Fix "single player mode" filtering of highlights. It was assuming
  that $scope.persona was an object rather than a string.
- Remove multiple checks to ensure that payload is an array, the
  backend only sends arrays[1][2].
- Convert python style method docstrings to coffeescript comments.

[1]: https://github.com/hypothesis/h/blob/master/h/streamer.py#L562
[2]: https://github.com/hypothesis/h/blob/master/h/streamer.py#L488

Simplified auth plugin

- Bridge the for identity service
- Handles login, logout, and exposes the current logged in user
- permits function for authorizing actions

Privacy directive doesn't fill the permissions if the annotation has
already have them and the replies permissions were not filled, only
the reading permissions

Before that the privacy directive detected that other way.

Fix #1759