Util styles should come after component styles

This should make it easier to speed up test runs in future by
pre-building npm dependencies into a separate bundle which the main test
bundle can import from.

The CommonJS plugin is the second most expensive transform after Babel.
Since all of our own code uses ES modules, limit it to npm dependencies
to speed up the build.

In tests the Babel transform has also been moved last so that additional
code it generates is not unnecessarily processed by subsequent plugins.

Combined these changes speed up a build of the full test bundle by ~4s.

This fixes a slow test on this branch, which appears to be caused by an
interaction between using `postMessage` to serialize native Error
objects and the `source-map-support` Karma plugin that we use.

Sending native Errors via `PortRPC` currently doesn't work in all
browsers so I expect we'll want to implement our own serialization of
errors in `PortRPC` to work around that. That can also work around the
`source-map-support`/`postMessage` issue in Chrome in future.

To move the Browserify => Rollup conversion forwards, this commit just
changes the test to use an Error-like rather than actual Error object.

`sinon` is exposed as a global in the test environment so it doesn't
need to be imported. Additionally some of the dependencies of Sinon
(samsam, nise) cause warnings about circular dependencies and use of
`eval` when bundled by Rollup.

Add comments to clarify a few things about the way the tests are built
and run.

Due to pre-existing `<script>` tags on third-party websites that load
the client's boot script, via https://hypothes.is/embed.js, we need to
keep generating it as a classic rather than ES module script for now.

This prevents a warning from Rollup about use of `this` outside a class
or (non-arrow) function in development builds, due to the way Babel
compiles JSX expressions [1]. Moving top-level code into a function is
also useful in case we ever want to write tests for it.

[1] https://github.com/babel/babel/issues/9149

Since the exclusion is no longer triggered by logic in the source code,
add a note about where this happens.

Make conditional exclusion of modules work the same way in the app
bundle as in the tests bundle.

Fix an occasional error from Gulp about a missing `boot.bundle.js` file
when running `make dev` for the first time after `make clean`. This can
happen if `updateManifest` runs before Rollup has generated
`boot.bundle.js`. The error can be safely ignored as `updateManifest`
will be re-run after `boot.bundle.js` is generated.

See https://github.com/hypothesis/browser-extension/pull/681

Replace Browserify with Rollup as a module bundler. This brings several
advantages:

- It is a more modern bundler that has better support in the ecosystem,
  more active maintenence, fewer dependencies and is easier to write plugins for.
  The core team also maintain most of the plugins that we need.

- It has native support for modern platform features like ES modules,
  including dynamic import for lazy-loading of functionality.

- It generates smaller bundles due to its ability to do tree shaking and scope hoisting.

The new bundles are generated as ES modules rather than UMD / IIFE bundles.
Our target browsers now all support ES modules and this will enable us to use
native static/dynamic imports for code splitting or lazy-loading of
functionality in future.

The initial Rollup build generates one bundle per application (boot script,
annotator, sidebar). This simplifies the build process and minimizes production
bundle size, at the cost of making incremental updates during development
slightly slower.

Build performance is currently similar to or a little slower than Browserify.
We can optimize this by adding caching of transforms (mainly Babel) and
pre-building of a vendor bundle containing large dependencies.

As part of changing the bundler this also changes how the code is packaged
for tests.  We now do the bundling ourselves rather than using a Karma
integration. This makes it much easier to inspect the processed code and fix
problems. It also makes it easier to optimize the bundle building in future.

The CrossFrame class was a thin wrapper around the Bridge connection
between guest and sidebar and wasn't really encapsulating any
functionality.

Simplify the code by removing this non-abstraction and moving the Bridge
and AnnotationSync construction directly into the Guest class. Also
reorganize the Guest constructor to better group together related logic.

In the anchoring integration test the CrossFrame stub has simply been
removed rather than replaced because it isn't necessary. As long as
`Guest.connectToSidebar` is not called, all the Bridge method calls will
have no effect.

Bumps [@babel/preset-env](https://github.com/babel/babel/tree/HEAD/packages/babel-preset-env) from 7.15.6 to 7.15.8.
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.15.8/packages/babel-preset-env)

---
updated-dependencies:
- dependency-name: "@babel/preset-env"
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [postcss](https://github.com/postcss/postcss) from 8.3.8 to 8.3.9.
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/postcss/postcss/compare/8.3.8...8.3.9)

---
updated-dependencies:
- dependency-name: postcss
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@sentry/browser](https://github.com/getsentry/sentry-javascript) from 6.13.2 to 6.13.3.
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/master/CHANGELOG.md)
- [Commits](https://github.com/getsentry/sentry-javascript/compare/6.13.2...6.13.3)

---
updated-dependencies:
- dependency-name: "@sentry/browser"
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) from 7.15.5 to 7.15.8.
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.15.8/packages/babel-core)

---
updated-dependencies:
- dependency-name: "@babel/core"
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [autoprefixer](https://github.com/postcss/autoprefixer) from 10.3.6 to 10.3.7.
- [Release notes](https://github.com/postcss/autoprefixer/releases)
- [Changelog](https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md)
- [Commits](https://github.com/postcss/autoprefixer/compare/10.3.6...10.3.7)

---
updated-dependencies:
- dependency-name: autoprefixer
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.999.0 to 2.1004.0.
- [Release notes](https://github.com/aws/aws-sdk-js/releases)
- [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js/compare/v2.999.0...v2.1004.0)

---
updated-dependencies:
- dependency-name: aws-sdk
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [core-js](https://github.com/zloirock/core-js) from 3.18.1 to 3.18.2.
- [Release notes](https://github.com/zloirock/core-js/releases)
- [Changelog](https://github.com/zloirock/core-js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/zloirock/core-js/compare/v3.18.1...v3.18.2)

---
updated-dependencies:
- dependency-name: core-js
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@octokit/rest](https://github.com/octokit/rest.js) from 18.11.4 to 18.12.0.
- [Release notes](https://github.com/octokit/rest.js/releases)
- [Commits](https://github.com/octokit/rest.js/compare/v18.11.4...v18.12.0)

---
updated-dependencies:
- dependency-name: "@octokit/rest"
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@hypothesis/frontend-shared](https://github.com/hypothesis/frontend-shared) from 3.12.0 to 3.13.0.
- [Release notes](https://github.com/hypothesis/frontend-shared/releases)
- [Changelog](https://github.com/hypothesis/frontend-shared/blob/main/CHANGELOG.md)
- [Commits](https://github.com/hypothesis/frontend-shared/compare/v3.12.0...v3.13.0)

---
updated-dependencies:
- dependency-name: "@hypothesis/frontend-shared"
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

Follow up of https://github.com/hypothesis/client/pull/3807

* reference to the `crossframe` service is inaccurate
* changed default export to a named export, as per team conventions

Follow up of https://github.com/hypothesis/client/pull/3807

* reference to the `crossframe` service is inaccurate
* changed default export to a named export, as per team conventions

* add information about why to use `window.load` instead of
  `document.DOMContentLoaded` to check when a document is ready

* use an invalid local URL (http://localhost:1) to speed DNS lookup in
  the test

* include some comments about the use of `waitForFrameObserver` in the
  tests

Instead of override the window.hypothesisConfig, I provide the
`externalContainerSelector` through a JSON script tag. This allows a
more incremental way to add configuration options.

When injecting the client into a guest frame, proxy any custom asset locations
specified via `.js-hypothesis-config` script tags in the host frame.
These are used by the browser extension and needed for the VitalSource
integration to work in that context.

We could probably avoid copying the `sidebarAppUrl` and `notebookAppUrl`
settings for guest-only frames. This will require changes to the boot
script and possibly the annotator entry point.

Implement the `injectClient` method of Guest that is used by
integrations (eg. VitalSource) to inject the client into a chosen frame.

In the process the `HypothesisInjector` class has been extracted out of
the `CrossFrame` class, since it is unrelated to the rest of the
functionality in that class and only lived their because of its
dependence on the `Bridge` instance, which will soon be removed (see
https://github.com/hypothesis/client/pull/3812). It is now constructed
and used directly by the `Guest` class instead.

Expose the existing logic for injecting the client into a target frame
in HypothesisInjector as a public `injectClient` method and modify it to
wait for the document to be loaded if necessary. This method will be
used by the guest class to inject the client into specific frames when
requested by the current integration.

In the case where the frame is discovered by `FrameObserver` this means
that `onDocumentReady(frame)` will be called twice. That's OK because
the second call will just complete immediately if the frame is already
ready.

Change how the sidebar is notified of guest frames being unloaded to
support guest frames where the client has been loaded via means other
than `HypothesisInjector` or where the guest is cross-origin.

Instead of listening for the guest frame's 'unload' event from the
parent frame in `HypothesisInjector`, the guest frame instead listens
for this event itself and sends a `hypothesisGuestUnloaded` message to
the host frame via `window.postMessage`, which in turn is handled in the
`Sidebar` class to relay it to the sidebar app via a `destroyFrame` RPC
call. This indirect route works around a bug in Safari (see code
comments).

As well as supporting future use cases, this also simplifies the
`HypothesisInjector` class as it no longer needs access to the `Bridge`.

This enables testing handling of the client's discovery of existing
frames (on page load) as well as handling of dynamic addition and removal after
the client has started.