Convert "flash" service to JS

Enable feature flagging in the annotation layer

Remove `angular.bind` dependency since `Function.prototype.bind` is now
ubiquitous.

Upgrade Sinon.JS to its latest version

Rename config.app to sidebarAppUrl

The code in `src/boot/` reads the `sidebarAppUrl` setting from
`js-hypothesis-config` JSON objects in the host page (defaulting to the
value of the build-time `__SIDEBAR_APP_URL__` template variable, if there's
no `sidebarAppUrl` setting in the host page).

`boot/` then writes `sidebarAppUrl` as the value of the `href` of a
`<link type="application/annotator+html">` element that it injects into
the host page.

Later, the code in `src/annotator/` reads this `<link>` element's `href`
in as the `config.app` setting, which it uses as the `src` of the
sidebar app's `<iframe>` that it injects into the host page.

So the variable that's named `sidebarAppUrl` / `__SIDEBAR_APP_URL__` at
boot / build time* gets renamed to `config.app` when it makes it into
the `src/annotator` code.

Fix this by renaming `config.app` in `src/annotator` to
`config.sidebarAppUrl` so that the variable is named consistently.

`*` In the build-time code there's also a `defaultSidebarAppUrl`
variable, and an `H_SERVICE_URL` environment variable, which also belong to
the same sidebarAppUrl config setting.

Add showHighlights() settings function

Return null, rather than undefined, if a host page setting isn't defined
in the host page.

This is because null, rather than undefined, is commonly used in this
codebase to explicitly denote "not found".

strictEqual() can tell the difference between null and undefined,
whereas equal() can't.

Rename H_SERVICE_URL to SIDEBAR_APP_URL

This groups all of the logic for the config.showHighlights setting (both
how it's read from the host page, and how the host page's value is
transformed afterwards) into one unit-tested place.

The `H_SERVICE_URL` environment variable is only used for one thing: to
set the value of the `defaultSidebarAppUrl` variable (to
https://hypothes.is/app.html in production or localhost:5000/app.html in dev)
by appending `/app.html` to the end of the environment variable's value.

For consistency with the config setting and variables that it's used to
control, rename `H_SERVICE_URL` to `SIDEBAR_APP_URL` and require the
user to include the `/app.html` ending in the environment variable's
value.

Also rewrite the documentation for this environment variable to make it
clearer what it's used for.

**Note**: This change means that developers who're using the
`H_SERVICE_URL` environment variable in their development environments
will need to:

1. Rename `H_SERVICE_URL` it to `SIDEBAR_APP_URL` in their environment
2. Append `/app.html` to the end of the environment variable's value

For example:

    export SIDEBAR_APP_URL="http://localhost:5000/app.html"

The developer docs for this environment variable have been updated to reflect
this.

Remove assetRoot and sidebarAppUrl from annotator

Remove the assetRoot and sidebarAppUrl config settings, which are read
from js-hypothesis-config objects in the host page, from the
src/annotator code.

These settings aren't used in the src/annotator code, they're used in
the src/boot code only.

Convert shared Bridge class to JS

Fix warning about loading Angular twice in tests

Convert localStorage service to JS

Remove unused "host" service

This reverts commit 4521cb4d.

Add --force to yarn install command

Attempting to fix this error with the client build on Jenkins:

    Error during loading "/data/jenkins/workspace/client_master-*/node_modules/karma-phantomjs-launcher" plugin:
      Path must be a string. Received null

Update docs to mandatory apiUrl field in the service.

 * Improve JSDoc comments

 * Remove `initClass` method which is unnecessary since all fields are
   initialized in the constructor

I removed the unnecessary use of Angular DI from the tests.

Enable reading openLoginForm and openSidebar from the host page

The Angular.js bundle was evaluated a second time because a module that
required angular was proxyquire-d in session-test.js. When
`proxyquire(...)` loads a module, it does so with a fresh, empty module
cache [1] which is removed once the `proxyquire(...)` call returns.

As a result, every module that is transitively required by the
proxyquire'd module will be re-evaluated during the `proxyquire(...)`
call.

Aside from the performance cost for large modules, this is also bad for
any module which has side-effects as part of its evaluation. Angular
happens to detect this and abort when evaluated a second time.

The fix here is to use Angular's DI system to mock the only stubbed
dependencies instead of proxyquire.

[1] The _module cache_ is a (module ID/name => exports object) map.

Whitelist the openLoginForm and openSidebar settings as being readable
from the host page even when the client is in a browser extension.

When you first install the Chrome extension it opens the /welcome page
in a tab, and it injects the openLoginForm and openSidebar settings into
the /welcome page in order to get the sidebar and login form to
automatically open on that page.

A previous change to prevent the Chrome extension from reading settings
from the page broke this /welcome page behaviour.

Fix it again by whitelisting the two required settings.

Of course this means that any page on the internet, not just the
/welcome page, and control these two settings, which is not what we
want, but it will do for now.

Add an allowInBrowserExt boolean option to hostPageSetting() so that
some host page settings can be white-listed as readable from the host
page even when the client is in a browser extension.